ECSS-E-ST-32-01C Rev. 1
6 March 2009
Space engineering
Fracture control
ECSS Secretariat
ESA-ESTEC
Requirements & Standards Division
Noordwijk, The Netherlands
ECSS‐E‐ST‐32‐01CRev.1
6March2009
2
Foreword
This Standard is one of the series of ECSS Standards intended to be applied together for the
management, engineering and product assurance in space projects and applications. ECSS is a
cooperative effort of the European Space Agency, national space agencies and European industry
associationsforthepurposeofdevelopingand
maintainingcommonstandards.Requirementsinthis
Standardaredefinedintermsofwhatshallbeaccomplished,ratherthanintermsofhowtoorganize
and perform the necessary work. This allows existing organizational structures and methods to be
appliedwherethey are effective,and for thestructuresand methods to evolve
as necessarywithout
rewritingthestandards.
This Standard has been prepared by the ECSS‐E‐ST‐32‐01 Working Group, reviewed by the ECSS
ExecutiveSecretariatandapprovedbytheECSSTechnicalAuthority.
Disclaimer
ECSSdoesnotprovideanywarrantywhatsoever,whetherexpressed,implied,orstatutory,including,
butnotlimitedto,
anywarrantyofmerchantabilityorfitnessforaparticularpurposeoranywarranty
that the contents of the item are error‐free. In no respect shall ECSS incur any liability for any
damages,including,butnotlimitedto, direct,indirect,special,orconsequentialdamagesarisingout
of, resulting from, or
in any way connectedto the useof this Standard, whether or not based upon
warranty,businessagreement,tort, or otherwise; whether ornotinjury wassustained bypersons or
propertyorotherwise;andwhetherornotlosswassustainedfrom,oraroseoutof,theresultsof,the
item,or
anyservicesthatmaybeprovidedbyECSS.
Publishedby: ESARequirementsandStandardsDivision
ESTEC, P.O. Box 299,
2200 AG Noordwijk
The Netherlands
Copyright: 2009 © by the European Space Agency for the members of ECSS
ECSS‐E‐ST‐32‐01CRev.1
6March2009
3
Change log
ECSS‐E‐30‐01A
13April1999
Firstissue
ECSS‐E‐ST‐32‐01B Neverissued
ECSS‐E‐ST‐32‐01C
15November2008
Secondissue
Themainchangesaresummarizedbelow:
• 6.3.5–metalliclowriskfractureitemsareintroduced.
• 6.4.4–fracturecontrolsummaryreportintroduced.
• 7–variousimprovements,incl.B‐valuesforlowerboundproperties
andapplicationofEPFMwhere
appropriate.
• 8.2–referenceisnowmadetoECSS‐E‐ST‐32‐02forpressurized
hardware;pressurizedstructuresandhazardousfluidcontainersare
introduced.
• 8.3–requirementsforweldingareupdatedandincludenowreference
tostandardizednomenclature.
• 8.4&10.5–requirementsforcomposite,bondedan d
sandwichitem sare
significantlyupdated:majorchangesaremadeinordertoaddres stherisk
ofdegradationdue to impactdamageandtocomp lementtheexisting
verificationbymeansofprooftesting (alsoappl icab le toclause11).
• 8.7–requirementsforglasscomponentsareupdated(incl.improved
coherencewithSSP
30560A).
• 8.8–requirementsforfastenersareupdated.
• 10.3–requirementsforNDIareupdatedandincludenowmoredetails
onstandardNDI;theTable2ofECSS‐E‐31‐01Aisnowdeleted.
• 10.7–requirementsfordetecteddefectsareintroduced.
• 11–updatedto
includehighlyloadedmetallicsafelifeitems;some
specialrequirementsaredeleted.
• ForDRDsoffracturecontroldocumentation,referenceisnowmadeto
ECSS‐E‐ST‐32.
• CoherencewithotherstructuralECSSstandardshasbeenchecked.
• Coordinationwithrecentdevelopmentsinfracturecontrol
standardizationatNASA,e.g.reflected
inNASA‐STD‐5019,NASA‐
STD‐5009andMSFC‐RQMT‐3479.
• SubstantialeditingofthetexttocomplywithECSSdraftingrules.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
Secondissuerevision1
ChangeswithrespecttoversionC(15November2008)areidentifiedwith
revisiontracking.
Mainchangesare:
• Requirement8.7c.,onpage59,containedduplicatedrequirements.The
duplicateswereremoved.Clause8.7containsintotal9requirements
ECSS‐E‐ST‐32‐01CRev.1
6March2009
4
(8.7a.to8.7.i).
• Correctionofnormativereferences.
• Splitofterms“catastrophichazard”and“crackaspectratio,a/c”into
twoterms.
• Additionofmissingabbreviatedtermsfor“F
ty,FtuandKC.
• Thesinglerequirementofclause10.5.2.2.3“Prooftestmonitoring”
movedto10.5.2.2.1asrequirement“e.”,clauseheader10.5.2.2.3
deleted.
• Deletionofclauseheader11.2.2.2“Identificationofpotentialfracture‐
criticalitems”(whichhadessentiallythesametitleas11.2.2.1),causing
arenumberingofitsonlyrequirementtorequirement11.2.2.1b.,
and
renumberingoffollowingclauses.
• Editorialchanges
ECSS‐E‐ST‐32‐01CRev.1
6March2009
5
Table of contents
Change log.................................................................................................................3
1 Scope.......................................................................................................................9
2 Normative references...........................................................................................10
3 Terms, definitions and abbreviated terms..........................................................12
3.1 Terms from other standards .....................................................................................12
3.2 Terms specific to the present standard ....................................................................13
3.3 Abbreviated terms ....................................................................................................19
4 Principles ..............................................................................................................21
5 Fracture control programme ...............................................................................23
5.1 General.....................................................................................................................23
5.2 Fracture control plan ................................................................................................23
5.3 Reviews....................................................................................................................24
5.3.1 General.......................................................................................................24
5.3.2 Safety and project reviews .........................................................................25
6 Identification and evaluation of PFCI..................................................................27
6.1 Identification of PFCIs ..............................................................................................27
6.2 Evaluation of PFCIs..................................................................................................28
6.2.1 Damage tolerance ......................................................................................28
6.2.2 Fracture critical item classification..............................................................30
6.3 Compliance procedures ...........................................................................................30
6.3.1 General.......................................................................................................30
6.3.2 Safe life items.............................................................................................30
6.3.3 Fail-safe items ............................................................................................31
6.3.4 Contained items..........................................................................................32
6.3.5 Low-risk fracture items ...............................................................................33
6.4 Documentation requirements ...................................................................................38
6.4.1 Fracture control plan...................................................................................38
6.4.2 Lists ............................................................................................................38
ECSS‐E‐ST‐32‐01CRev.1
6March2009
6
6.4.3 Analysis and test documents......................................................................38
6.4.4 Fracture control summary report ................................................................38
7 Fracture mechanics analysis...............................................................................40
7.1 General.....................................................................................................................40
7.2 Analytical life prediction............................................................................................41
7.2.1 Identification of all load events ...................................................................41
7.2.2 Identification of the most critical location and orientation of the crack........41
7.2.3 Derivation of stresses for the critical location .............................................42
7.2.4 Derivation of the stress spectrum...............................................................42
7.2.5 Derivation of material data..........................................................................43
7.2.6 Identification of the initial crack size and shape .........................................43
7.2.7 Identification of an applicable stress intensity factor solution.....................44
7.2.8 Performance of crack growth calculations..................................................45
7.3 Critical crack-size calculation ...................................................................................45
8 Special requirements ...........................................................................................47
8.1 Introduction...............................................................................................................47
8.2 Pressurized hardware ..............................................................................................47
8.2.1 General.......................................................................................................47
8.2.2 Pressure vessels ........................................................................................47
8.2.3 Pressurized structures................................................................................50
8.2.4 Pressure components.................................................................................50
8.2.5 Low risk sealed containers .........................................................................51
8.2.6 Hazardous fluid containers.........................................................................51
8.3 Welds .......................................................................................................................52
8.3.1 Nomenclature .............................................................................................52
8.3.2 Safe life analysis of welds ..........................................................................52
8.4 Composite, bonded and sandwich structures...........................................................53
8.4.1 General.......................................................................................................53
8.4.2 Defect assessment.....................................................................................53
8.4.3 Damage threat assessment........................................................................55
8.4.4 Compliance procedures..............................................................................56
8.5 Non-metallic items other than composite, bonded, sandwich and glass items ........59
8.6 Rotating machinery ..................................................................................................60
8.7 Glass components....................................................................................................60
8.8 Fasteners .................................................................................................................61
9 Material selection .................................................................................................63
ECSS‐E‐ST‐32‐01CRev.1
6March2009
7
10 Quality assurance and Inspection ....................................................................64
10.1 Overview ..................................................................................................................64
10.2 Nonconformances ....................................................................................................64
10.3 Inspection of PFCI....................................................................................................64
10.3.1 General.......................................................................................................64
10.3.2 Inspection of raw material...........................................................................65
10.3.3 Inspection of safe life finished items...........................................................66
10.4 Non-destructive inspection of metallic materials ......................................................67
10.4.1 General.......................................................................................................67
10.4.2 NDI categories versus initial crack size......................................................67
10.4.3 Inspection procedure requirements for standard NDI.................................71
10.5 NDI for composites, bonded and sandwich parts.....................................................74
10.5.1 General.......................................................................................................74
10.5.2 Inspection requirements .............................................................................75
10.6 Traceability...............................................................................................................76
10.6.1 General.......................................................................................................76
10.6.2 Requirements .............................................................................................77
10.7 Detected defects ......................................................................................................77
10.7.1 General.......................................................................................................77
10.7.2 Acceptability verification .............................................................................78
10.7.3 Improved probability of detection................................................................79
11 Reduced fracture control programme ..............................................................80
11.1 Applicability ..............................................................................................................80
11.2 Requirements ...........................................................................................................80
11.2.1 General.......................................................................................................80
11.2.2 Modifications...............................................................................................80
Annex A (informative) The ESACRACK software package..................................82
Annex B (informative) References.........................................................................83
Bibliography.............................................................................................................84
Figures
Figure 5-1: Identification of PFCI............................................................................................24
Figure 6-1: Fracture control evaluation procedures ...............................................................29
Figure 6-2: Safe life item evaluation procedure for metallic materials....................................35
Figure 6-3: Safe life item evaluation procedure for composite, bonded and sandwich
items ....................................................................................................................
36
ECSS‐E‐ST‐32‐01CRev.1
6March2009
8
Figure 6-4: Evaluation procedure for fail-safe items...............................................................37
Figure 8-1: Procedure for metallic pressure vessel and metallic liner evaluation ..................49
Figure 10-1: Initial crack geometries for parts without holes..................................................73
Figure 10-2: Initial crack geometries for parts with holes.......................................................74
Figure 10-3: Initial crack geometries for cylindrical parts .......................................................74
Tables
Table 8-1: Factor on stress for sustained crack growth analysis of glass items ....................61
Table 10-1: Initial crack size summary, standard NDI............................................................70
ECSS‐E‐ST‐32‐01CRev.1
6March2009
9
1
Scope
This ECSSEngineering Standard specifies the fracture control requirements to
beimposedonspacesegmentsofspacesystemsandtheirrelatedGSE.
The fracture control programme is applicable for space systems and related
GSE when required by ECSS‐Q‐ST‐40 or by the NASA document NST 1700.7,
incl.ISSaddendum.
The requirements contained in this Standard, when implemented, also satisfy
the fracture control requirements applicable to the NASA STS and ISS as
specifiedintheNASAdocumentNSTS1700.7(incl.theISSAddendum).
TheNASA nomenclature differs insomecasesfromthat used by ECSS.When
STS/ISS‐specific requirements and
nomenclature are included, they are
identifiedassuch.
Thisstandardmaybetailoredforthespecificcharacteristicandconstrainsofa
spaceprojectinconformancewithECSS‐S‐ST‐00.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
10
2
Normative references
The following normative documents contain provisions which, through
reference in this text, constitute provisions of this ECSS Standard. For dated
references,subsequentamendmentsto,orrevisionofanyofthesepublications
donotapply,However,partiestoagreementsbasedonthisECSSStandardare
encouragedtoinvestigatethepossibilityofapplying
themorerecenteditionsof
the normative documents indicated below. For undated references, the latest
editionofthepublicationreferredtoapplies.
ECSS‐S‐ST‐00‐01 ECSSsystem–Glossaryofterms
ECSS‐E‐ST‐32
Spaceengineering–Structural
ECSS‐E‐ST‐32‐02 Spaceengineering–Structuraldesignand
verificationofpressurizedhardware
ECSS‐Q‐ST‐20 Spaceproductassurance–Qualityassurance
ECSS‐Q‐ST‐40 Spaceproductassurance–Safety
ECSS‐Q‐ST‐70 Spaceproductassurance–Materials,mechanical
partsandprocesses
ECSS‐Q‐ST‐70‐36 Spaceproductassurance–Materialselectionfor
controllingstress‐corrosioncracking
ECSS‐Q‐ST‐70‐45 Spaceproductassurance–Mechanicaltestingof
metallicmaterials
ASTME164 StandardPracticeforUltrasonicContact
ExaminationofWeldments
ASTME426 StandardPracticeforElectromagnetic(Eddy‐
Current)
ExaminationofSeamlessandWelded
TubularProducts,AusteniticStainlessSteeland
SimilarAlloys
ASTME1417 StandardPracticeforLiquidPenetrantExamination
ASTME1444 StandardPracticeforMagneticParticleExamination
ASTME1742 StandardPracticeforRadiographicExamination
DOT/FAA/AR‐
MMPDS
MetallicMaterialsPropertiesDevelopmentand
Standardization(MMPDS)(formerMIL‐HDBK
‐5)
EN4179 Aerospace–QualificationandAuthorizationof
PersonnelforNon‐destructiveTesting
ECSS‐E‐ST‐32‐01CRev.1
6March2009
11
ENISO6520‐1 Weldingandalliedprocesses–Classificationof
geometricimperfectionsinmetallicmaterials–Part
1:Fusionwelding
ISO17659 Welding–Multilingualtermsforweldedjointswith
illustrations
MIL‐HDBK‐6870 Inspectionprogramrequirements,nondestructive,
foraircraftandmissilematerialsandparts
NAS‐410 Nondestructivetestingpersonnel
qualificationand
certification
NSTS1700.7 SafetyPolicyandRequirementsForPayloadsUsing
theSpaceTransportationSystem(STS)
NSTS1700.7ISS
Addendum
SafetyPolicyandRequirementsForPayloadsUsing
theInternationalSpaceStation
SAEAMS‐STD‐2154
Processforinspection,ultrasonic,wroughtmetals
SAEAMS2644 InspectionMaterial,Penetrant
NSTS/ISS13830 PayloadSafetyReviewandDataSubmittal
RequirementsForPayloadsUsingtheSpaceShuttle
&InternationalSpaceStation
ECSS‐E‐ST‐32‐01CRev.1
6March2009
12
3
Terms, definitions and abbreviated terms
3.1 Terms from other standards
ForthepurposeofthisStandard,thetermsanddefinitionsfromECSS‐ST‐00‐01
apply,inparticularforthefollowingterms:
customer
NOTE In this standard, the customer is considered to
represent the responsible fracture control or
safetyauthority.
ForthepurposeofthisStandard,thefollowingtermand
definitionfromECSS‐
E‐ST‐10‐03apply:
prooftest
For the purpose of this Standard, the following terms
and definitions from
ECSS‐E‐ST‐32apply:
flaw
NOTE Thetermdefectisusedasasynonymous.
maximumdesignpressure(MDP)
servicelife
ForthepurposeofthisStandard,thefollowingtermanddefinitionfromECSS‐
E‐ST‐32‐02apply:
burstpressure
hazardousfluidcontainer
leakbeforeburst,LBB
pressurecomponent
pressurevessel
pressurizedstructure
sealedcontainer
specialpressurizedequipment
visualdamagethreshold,VDT
NOTE1 For typical implementation of thin‐walled
composite structure, the VDT is sometimes more
specifically defined as the impact energy of an
ECSS‐E‐ST‐32‐01CRev.1
6March2009
13
impactor with a hemi‐spherical tip of 16 mm
diameter resulting in 0,3mm or more remaining
surface deflection, after sufficiently long time to
cover potential evolution of the indentation over
time (due to e.g. wet ageing, fatigue loading,
viscoelasticity of the resin) between impact and
inspection.
NOTE2 It can
be time consuming to determine the VDT
based on remaining surface deflection of 0,3mm
(see NOTE 1) after a sufficiently long time.
Therefore, tests which cause mechanical damage
corresponding to a deflection of at least 1mm,
immediately after impact, are sometimes used to
determinetheVDT.
Forthe
purposeofthisStandard,thefollowingtermanddefinitionfromECSS‐
Q‐ST‐40apply:
catastrophichazard
criticalhazard
3.2 Terms specific to the present standard
3.2.1 aggressive environment
combination of liquid or gaseous media and temperature that alters static or
fatiguecrack‐growth characteristicsfromnormalbehaviourassociatedwith an
ambienttemperatureandlaboratoryairenvironment
3.2.2 analytical life
lifeevaluatedanalyticallybycrack‐growthanalysisorfatigueanalysis
3.2.3 catastrophic hazard
<otherthanNASASTSorISSpayloads>seeECSS‐Q‐ST‐40B
3.2.4 catastrophic hazard
<NASA STS or ISS payloads> potential risk situation that can result in a
disabling or fatal personnel injury, loss of the NASA orbiter, ISS, ground
facilities,orSTS/ISSequipment
[NSTS1700.7incl.ISSAddendum,paragraph302]
3.2.5 close visual inspection
closeproximity,intensevisualexaminationoftheinternalandexternalsurfaces
ofastructure,includingstructuraldetailsorlocations,forindicationsofimpact
damage,flaws,andothersurfacedefects
NOTE The inspection capability is evaluated by the
surfacedeflectionmeasurement(impactdepth).
The close visual inspection is considered to
ECSS‐E‐ST‐32‐01CRev.1
6March2009
14
detect reliably a deflection larger than the
visualdamagethreshold(VDT).
3.2.6 containment
damagetolerancedesignprinciplethat,ifapartfails,preventsthepropagation
offailureeffectsbeyondthecontainerboundaries
NOTE1 AcontainedpartisnotconsideredPFCI,unlessits
release can cause a hazard inside the container.
ThecontainerisaPFCI,anditsstructuralintegrity
after impact is verified
as part of fracture control
activities.
NOTE2 In this standard, the term containment in most
casesalsocoversitemswhicharee.g.restrainedby
a tether to prevent the occurrence of hazardous
eventsduetofailureoftheitem.
3.2.7 crack-like defect
defectthathasthesamemechanicalbehaviourasacrack
NOTE1 “Crack” and “crack‐like defect” are considered
synonymousinthisstandard.
NOTE2 Crack‐like defects can, for example, be initiated
during material production, fabrication or testing
or developed during the service life of a
component.
NOTE3 The
term“crack‐likedefect”caninclude:
• For metallic materials flaws, inclusions,
poresandothersimilardefects.
• For non‐metallic materials, debonding,
brokenfibres,delamination,impactdamage
and other specific defects depending on the
material.
3.2.8 crack aspect ratio, a/c
<part‐throughsurfacecrack>ratioofcrackdepthtohalfcracklength
3.2.9 crack aspect ratio, a/c
<part‐throughcornercrack>ratioofcrackdepthtocracklength
3.2.10 crack growth rate
rateofchangeof crackdimensionwithrespecttothenumberofload cyclesor
time
NOTE Forexampleda/dN,dc/dN,da/dtanddc/dt.
3.2.11 crack growth retardation
reduction of crack‐growth rate due to overloading of the cracked structural
member
ECSS‐E‐ST‐32‐01CRev.1
6March2009
15
3.2.12 critical crack size
thecracksizeatwhichthestructurefailsunderthemaximumspecifiedload
NOTE The maximum specified load is in many cases
the limit load, but sometimes higher than the
limitload(e.g.fordetecteddefects, composites
andglassitems)
3.2.13 critical initial defect, CID
critical(i.e.,maximum)initialcracksizeforwhichthestructurecansurvivethe
specifiednumberoflifetimes.
3.2.14 critical stress-intensity factor
value of the stress‐intensity factor at the tip of a crack at which unstable
propagationofthecrackoccurs
NOTE1 This value is also called the fracture toughness.
The parameter K
IC is the fracture toughness for
plane strain and is an inherent property of the
material. For stress conditions other than plane
strain, the fracture toughness is denoted K
C. In
fracture mechanics analyses, failure is assumed to
be imminent when the applied stress‐intensity
factor is equal to or exceeds its critical value, i.e.
thefracturetoughness.See
3.2.25.
NOTE2 The term fracture toughness is used as a
synonymous.
3.2.15 cyclic loading
fluctuatingload(or pressure) characterizedby relative degrees of loading and
unloadingofastructure
NOTE For example, loads due to transient responses,
vibro‐acoustic excitation, flutter, pressure
cycling and oscillating or reciprocating
mechanicalequipment.
3.2.16 damage tolerance threshold strain
<composite structural items> maximum strain level below which damage
compatible with the sizes established by non‐destructive inspection (NDI),
specialvisual inspection, thedamagethreatassessment, or theminimumsizes
imposeddoesnotgrowin10
6
cycles(10
8
cyclesforrotatinghardware)ataload
ratioappropriatetotheapplication
NOTE1 Strain level is the maximum absolute value of
straininaloadcycle.
NOTE2 The damage tolerance threshold strain is a
function of the material type and lay‐up and is
determined from test data
in the design
environment to the applicable or worst type and
orientation of strain and flaw for a particular
ECSS‐E‐ST‐32‐01CRev.1
6March2009
16
design and flaw size (e.g. the size determined by
theVDT).
3.2.17 damage tolerant
characteristicofastructureforwhichtheamountofgeneraldegradationorthe
sizeanddistributionoflocaldefectsexpectedduringoperation,orboth,donot
leadtostructuraldegradationbelowspecifiedperformance
3.2.18 defect
see‘flaw’(3.1)
3.2.19 detected defect
defectknowntoexistinthehardware
3.2.20 fail-safe
<structures> damage‐tolerance design principle, where a structure has
redundancy to ensure that failure of one structural element does not cause
generalfailureoftheentirestructureduringtheremaininglifetime
3.2.21 fastener
itemthatjoinsother structuralitemsandtransfersloadsfrom onetothe other
acrossajoint
3.2.22 fatigue
cumulative irreversible damage incurred by cyclic application of loads to
materialsandstructures
NOTE1 Fatigue can initiate and extend cracks, which
degradethestrengthofmaterialsandstructures.
NOTE2 Examples of factors influencing fatigue behaviour
of the material are the environment, surface
conditionandpartdimensions
3.2.23 fracture critical item
itemclassifiedassuch
3.2.24 fracture limited life item
hardware item that requires periodic re‐inspection or replacement to be in
conformancewithfracturecontrolrequirements
3.2.25 fracture toughness
materials’resistancetotheunstablepropagationofacrack
NOTE Seecriticalstressintensityfactor,
3.2.14.
3.2.26 initial crack size
maximumcracksize,asdefinedbynon‐destructiveinspection,forperforminga
fracturecontrolevaluation
ECSS‐E‐ST‐32‐01CRev.1
6March2009
17
3.2.27 joint
elementthatconnectsotherstructuralelementsandtransfersloadsfromoneto
theotheracrossaconnection
3.2.28 load enhancement factor, LEF
factortobeappliedontheloadlevelofthespectrumoffatiguetest(s)inorder
todemonstratewiththetest(s)aspecifiedlevelofreliabilityandconfidence
NOTE1 The LEF is dependent upon the material or
construction, the number of test articles, and the
durationofthetests.
NOTE
2 MIL‐HDBK‐17F, Volume 3, Section 7.6.3 gives an
approach for calculating the LEF for composite
structures.
3.2.29 loading event
condition,phenomenon, environmentormissionphaseto whichthestructural
systemisexposedandwhichinducesloadsinthe structure
3.2.30 load spectrum
representationof the cumulativestatic and dynamicloadingsanticipated for a
structuralelementduringitsservicelife
NOTE Loadspectrumisalsocalledloadhistory.
3.2.31 mechanical damage
induced flaw in a composite hardware item that is caused by external
influences,suchassurfaceabrasions,cuts,orimpacts
3.2.32 potential fracture critical item, PFCI
itemforwhichtheinitiationorpropagationofcracksinstructuralitemsduring
theservicelifecanresultinacatastrophicorcriticalhazard, orNASA STS/ISS
catastrophichazardousconsequences
NOTE Pressure vessels and rotating machinery are
alwaysconsideredPFCI.See
Figure5‐1.
3.2.33 R-ratio
ratiooftheminimumstresstomaximumstress
3.2.34 residual stress
stressthat remainsinthe structure, owing to processing, fabrication, assembly
orpriorloading
3.2.35 rotating machinery
rotatingmechanicalassemblythathasakineticenergyof19300joulesormore,
oranangularmomentumof136Nmsormore
NOTE Theamountofkineticenergyisbasedon0,5Iω
2
whereI isthe moment ofinertia (kg.m
2
)and ω
istheangularvelocity(rad/s).
ECSS‐E‐ST‐32‐01CRev.1
6March2009
18
3.2.36 safe life
fracture‐control design principle, for which the largest undetected defect that
canexist inthepart doesnot grow to failure when subjected to the cyclicand
sustainedloadsandenvironmentsencounteredintheservicelife
3.2.37 special NDI
NDI methods that are capable of detecting cracks or crack‐like flaws smaller
than those assumed detectable by Standard NDI or do not conform to the
requirementsforStandardNDI
NOTE1 See
10.4.2.1and10.4.3.
NOTE2 SpecialNDImethodsarenotlimitedtofluorescent
penetrant, radiography, ultrasonic, eddy current,
andmagneticparticle.Seealso
10.4.2.2.
3.2.38 standard NDI
NDI methods of metallic materials for which the required statistically based
flawdetectioncapabilityhasbeenestablished.anditislistedin
Table10‐1
NOTE1ForstandardNDI,seeclauses
10.4.2.1and10.4.3.
NOTE2 For required statistically based flaw detection
capability,see
10.4.2.1e.
NOTE2 LimitationsontheapplicabilityofstandardNDIto
radiographic NDI can be found in
10.4.2.1f and
10.4.2.1g.
NOTE4 Standard NDI methods addressed by this
document are limited to fluorescent penetrant,
radiography, ultrasonic, eddy current, and
magneticparticle.
3.2.39 stress-corrosion cracking, SCC
initiation or propagation, or both, of cracks, owing to the combined action of
applied sustained stresses, material properties and aggressive environmental
effects
NOTE The maximum value of the stress‐intensity
factor for a given material at which no
environmentally induced crack growth occurs
atsustainedloadforthespecifiedenvironment
isKISCC.
3.2.40 stress intensity factor, K
calculatedquantitythatisusedinfracturemechanicsanalysesasameasureof
thestress‐fieldintensitynearthetipofanidealisedcrack
NOTE Calculated for a specific crack size, applied
stresslevelandpartgeometry.See
3.2.14.
3.2.41 threshold stress intensity range, ΔK
th
stress‐intensity range below which crack growth does not occur under cyclic
loading
ECSS‐E‐ST‐32‐01CRev.1
6March2009
19
3.2.42 variable amplitude spectrum
loadspectrumorhistorywhoseamplitudevarieswithtime
3.3 Abbreviated terms
For the purpose of this Standard, theabbreviated terms from ECSS‐S‐ST‐00‐01
andthefollowingapply:
Abbreviation Meaning
a/c
crackaspectratio(see3.2.8)
AR
acceptancereview
ASME
AmericanSocietyofMechanicalEngineers
ASTM
AmericanSocietyforTestingandMaterials
BS
BritishStandard
CDR
criticaldesignreview
CID
criticalinitialdefect
COPV
compositeoverwrappedpressurevessel
DOT
UnitedStatesDepartmentofTransportation
DRD
documentrequirementsdefinition
EN
EuropeanStandard
EPFM
elastic‐plasticfracturemechanics
ESA
EuropeanSpaceAgency
FAD
failureassessmentdiagram
FCI
fracture‐criticalitem
FCIL
fracture‐criticalitemslist
FE
finiteelement
FLLI
fracture‐limitedlifeitem
FLLIL
fracture‐limitedlifeitemslist
FOD
foreignobjectdebris
Fty
designtensileyieldstrength(inMPa)
Ftu
designtensileultimatestrength(inMPa)
GSE
groundsupportequipment
ISO
InternationalOrganisationforStandardisation
ISS
InternationalSpaceStation
J‐Rcurve
resistancecurvebasedonJ‐integral
K‐Rcurve
resistancecurvebasedonstressintensityfactor(K)
LBB
leakbeforeburst
LEF
loadenhancementfactor
ECSS‐E‐ST‐32‐01CRev.1
6March2009
20
LEFM
linearelasticfracturemechanics
KC
fracturetoughnessforstressconditionsotherthanplane
strain
NOTE:SeeNOTE1ofdefinition3.2.14.
KIC
planestrainfracturetoughness
KISCC
thresholdstress‐intensityfactorforstress‐corrosioncracking
Δ
Kth
thresholdstress‐intensityrange
MDP
maximumdesignpressure
MEOP
maximumexpectedoperatingpressure
NASA
NationalAeronauticsandSpaceAdministration
NDI
non‐destructiveinspection
NHLBB
non‐hazardousleakbeforeburst
NSTS
NationalSpaceTransportationSystem(NASASpaceShuttle)
PDR
preliminarydesignreview
PFCI
potentialfracture‐criticalitem
PFCIL
potentialfracture‐criticalitemslist
R
ratiooftheminimumstresstomaximumstress
RFCP
reducedfracture‐controlprogramme
SAE
SocietyofAutomotiveEngineers
SCC
stress‐corrosioncracking
SI
internationalsystemofunits
SRR
systemrequirementsreview
STS
SpaceTransportationSystem(USSpaceShuttle)
US
ultrasonic
VDT
visualdamagethreshold
ECSS‐E‐ST‐32‐01CRev.1
6March2009
21
4
Principles
The following assumptions and prerequisites are the basis of the
implementation of the requirements contained in this standard. They can be
used as reference for example when alternative approaches, not directly
coveredbytherequirementsofthisstandard,areassessedforequivalentsafety
orreliability.
• All structural elements contain crack
‐like defects located in the most
criticalarea ofthecomponentinthemostunfavourableorientation.The
inability of non‐destructive inspection (NDI) techniques to detect such
defectsdoesnotnegatethisassumption,butmerelyestablishesanupper
boundontheinitialsizeofthecrackswhichresultfromthese
defects.For
conservatism,thiscracksizethenbecomesthesmallestallowablesizeto
beusedinanyanalysisorassessment.
• Afterundergoingasufficientnumberofcyclesatsufficientlyhighstress
amplitude,materialsexhibitatendencytopropagatecracks,eveninnon‐
aggressiveenvironments.
• Whether,undercyclicorsustained
tensilestress,apre‐existing(orload‐
induced)crackdoesordoesnotpropagatedependson:
⎯ thematerialbehaviourwithcrack;
⎯ theinitialsizeandgeometryofthecrack;
⎯ thepresenceofanaggressiveenvironment;
⎯ thegeometryoftheitem;
⎯ themagnitudeandnumberofloadingcycles;
⎯ thedurationofsustainedload;
⎯ thetemperatureofthematerial.
• Formetallicmaterials,theengineeringdisciplineoflinearelasticfracture
mechanics (LEFM) provides analytical tools for the prediction of crack
propagationand criticalcracksize.Validityof LEFM, depends onstress
level, crack configuration and structural geometry. The engineering
disciplineofelastic‐plasticfracturemechanics
(EPFM)providesanalytical
toolsforthepredictionofcrackinitiation,stableductilecrackgrowthand
criticalcracksize.
• For non‐metallic materials (other than glass and other brittle materials)
and fibre‐reinforced composites (both with metal and with polymer
matrix), linear elastic fracture mechanics technology is agreed by most
ECSS‐E‐ST‐32‐01CRev.1
6March2009
22
authoritiesto be inadequate,with the exception of interlaminarfracture
mechanics applied to debonding and delamination. Fracture control of
thesematerialsreliesonthetechniquesofsafelifeassessmentsupported
bytests,containment,failsafeassessment,andprooftesting.
Composite, bonded and sandwich items are manufactured and verified
to high quality
control standards to assure aerospace quality hardware.
Thehardwaredeveloperofcomposite, bondedandsandwichitemsuses
onlymanufacturingprocessesandcontrols(NDI,coupontests,sampling
techniques,etc.)thataredemonstratedtobereliableandconsistentwith
established aerospace industry practices for composite/bonded
structures.
• The observed scatter in measured
material properties and fracture
mechanicsanalysisuncertaintiesisconsidered.
NOTE Forexample,scatterfactorandLEF
• ForNSTSandISSpayloads,entitiescontrollingthepressurearetwo‐fault
tolerant,seeNSTS1700.7(incl.ISSAddendum).
NOTE For example, regulators, relief devices and
thermalcontrolsystems
ECSS‐E‐ST‐32‐01CRev.1
6March2009
23
5
Fracture control programme
5.1 General
a. Afracture control programme shall be implemented by the supplier for
spacesystemsandtheir related GSE in conformance with thisStandard,
when required by ECSS‐Q‐ST‐40 or the NASA document NSTS 1700.7,
incl.ISSAddendum(clause208.1).
b. Fracturecontrolrequirementsasdefinedinthisstandardshall
beapplied
wherestructuralfailurecanresultinacatastrophicorcriticalhazard.
NOTE In NASA NSTS 1700.7 (Safety Policy and
Requirements For Payloads Using the Space
Transportation System [STS]), incl. ISS
Addendum, the payload structural design is
based on fracture control procedures when the
failure of a structural item
can result in a
catastrophicevent.
c. Implementation offracture controlfor structural GSE may be limited to
itemswhicharenotcoveredbyotherstructuralsafetyrequirements.
NOTE In many cases this limits fracture control
verification to elements directly interfacing
withflighthardware.
d. Items for which implementation of
fracture control programme is
requiredshallbeselectedinconformancewith
Figure5‐1.
e. For unmanned, single‐mission, space vehicles and their payloads, and
GSEthereducedfracturecontrolprogramme,specifiedinclause
11,may
beimplemented.
5.2 Fracture control plan
a. The supplier shall prepare and implement a fracture control plan in
conformancewithECSS‐E‐ST‐32‘Fracturecontrolplan–DRD’.
b. Thefracturecontrolplanshallbesubjecttoapprovalbythecustomer.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
24
Yes
Designconcept
and
management
Mannedorreusable
projects
Unmanned,singlemission
projectsorGSE*
Reduced fracturecontrolper
clause11
Structuralscreening Hazardanalysis
Forreducedfracturecontrolidentifyitemspersubclause11.2
Fracturecontrolrequired
Fracturecontrolnot
required
Recorditemaspotential
fracture–criticalitem
Canfailureleadto
catastrophicor
criticalhazard?*
Isitemapressure
vesselorrotating
machinery?
Yes
No
No
Legend
* containedorrestraineditems(see
subclause6.3.4)aregenerallynot
consideredPFCI.Theircontainersare.
Figure5‐1:IdentificationofPFCI
5.3 Reviews
5.3.1 General
a. Fracturecontrol activitiesand statusshall bereported during all project
reviews.
NOTE Forprojectreviews,seeECSS‐M‐ST‐10.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
25
5.3.2 Safety and project reviews
a. Thescheduleoffracturecontrolactivitiesshallberelatedto,andsupport,
theprojectsafetyreviewschedule.
NOTE As specified in ECSS‐Q‐ST‐40, safety reviews
are performed in parallel with major project
reviews.
b. Fracture control documentation shall be provided for the reviews as
follows:
1. For
asystemrequirementsreview(SRR)
The results of preliminary hazard analysis and fracture control
screening(whichfollowsthemethodologygivenin
Figure5‐1)and
a written statement as to whether or not fracture control is
applicable.
2. Forapreliminarydesignreview(PDR)
(a) A written statement which either confirms that fracture
control is required or else provides a justification for not
implementingfracturecontrol.
(b) Identification of fracture control‐related
project activities in
thefracturecontrolplanincluding:
− Definition of the scope of planned fracture control
activities dependent upon the results of the hazard‐
analysisandfracturecontrolscreeningperformed.
− Identificationoflow‐riskfractureitems.
− Identification of primary design requirements and
constraints which are affected by
or affecting fracture
controlimplementation.
NOTE Forthefracturecontrolplan,see
5.2.
(c) Submission of the fracture control plan to the customer for
approval.
(d) Lists of potential fracture critical items and fracture critical
itemsinconformancewithclause
6.4.2.
3. Foracriticaldesignreview(CDR)
(a) A final fracture control plan which is approved by the
customer.
(b) Verification requirements for inspection procedures and
personnel.
(c) The status of fracture control activities, together with a
specificscheduleforcompletionoftheverificationactivities.
(d) A description and summary
of the results of pertinent
analysesandtests.
NOTE Seeclause
6.4.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
26
(e) List of potential fracture critical items in conformance with
clause
6.4.2.
(f) Listoffracturecr itic alitemsinconformancewithclause
6.4.2.
(g) Listoffracturelimited‐lifeitemsinconformancewithclause
6.4.2.
4. Foranacceptancereview(AR)orqualificationreview(QR)
(a) A fracture control summary report in conformance with
clause
6.4.4, showing completion of all fracture control
verificationactivities.
(b) Relevant test, inspection, procurement and analysis reports
inconformancewithclause
6.4.
(c) List of potential fracture critical items in conformance with
clause
6.4.2.
(d) Listoffracturecrit ical items inco nforman cewithclause
6.4.2.
(e) Listoffracturelimited‐lifeitemsinconformancewithclause
6.4.2.
(f) Pressure‐vesselsummarylog,and,forpayloadsoftheNSTS
and ISS, in conformance with NSTS/ISS 13830 clauses 7.2
and7.12.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
27
6
Identification and evaluation of PFCI
6.1 Identification of PFCIs
a. Fracture control screening of structural elements (structural screening)
shallbeperformedtoidentifyPFCIforthecompletestructure,including
relatedGSEdirectlyconnectedtotheflightstructure,exceptwhenclause
11applies.
NOTE Seealso
Figure5‐1.
b. When clause
11 applies, the fracture control screening of structural
elementsmaybelimitedtotheitemslistedin
11.2.2.1.
c. Forthepurposeof
6.1g,thestructuralscreeningtoidentifyPFCIshallbe
documented.
NOTE The screening results, incl. explanation why
certain structural items (if any) are not
considered as PFCI, can be reported e.g. in the
PFCIL
d. In support of the structural screening, the hazard analysis of the space
system, performed in
conformance with ECSS‐Q‐ST‐40 clause on
“Hazard analysis”, shall identify where structural failure of flight
hardwareorGSEitemscanresultincatastrophicorcriticalhazards.
NOTE1
The outcome of safety reviews can provide input
totheselectionofspecifichazardstobecontrolled
byfracturecontrolimplementation.
NOTE2
The hazard analysis can identify limits on mass
andvelocityofreleaseditemsdifferentfromthose
listedin
6.1e.
e. ForpayloadsontheNSTSorISS,includingtransportationeventstoISS,
the supplier shall identify structural items as PFCI, with potential to
causeacatastrophichazard:
1. Wherefailureoftheitemcanresultinthereleaseofanyelementor
fragment with a mass of more than
113,5g (0,25pounds) during
launchorlanding.
2. Wherefailureofthe itemcanresultinthereleaseorseparationof
anytensionpreloadedstructuralelementorfragmentwithamass
ofmorethan13g(0,03pounds)iftheitemhasafracturetoughness
(K
IC)totensileyieldstrengthratiolessthan1,66mm
½
(0,33in
1/2
),or
if the item is a steel bolt whose ultimate strength exceeds
1240MPa(180ksi).
ECSS‐E‐ST‐32‐01CRev.1
6March2009
28
3. Where failure of the item can result in the release of hazardous
substances.
4. Where failure of the item can prevent configuration for safe
descentfromorbit.
5. Where failure of the item can result in the release during zero
gravityflightofanymassthatcanimpactcriticalhardware
orcrew
personnel, with a velocity higher than 10,7m/s (35ft/s) or a
momentumexceeding1,21Ns(8,75ft–lb/s).
f. Containers and restraining elements, which prevent failed items from
creatingacatastrophicorcriticalhazard,shallbeclassifiedPFCI.
NOTE Inadditiontoverificationassafe‐lifeorfail
‐safe
or low risk item (as appropriate), containers
andrestrainingelementsareverifiedtoprovide
adequate containment or restraint in case of
failureoftheitems.
g. Potential fracture‐critical items (PFCI) identified in conformance with
6.1a, 6.1c, 6.1d, 6.1eshall be included in the potential fracture‐critical
itemlist(PFCIL),specifiedinclause
6.4.
h. In order to ensure that the implementation of the fracture control
programme is compatible with the current design and service‐life
scenario, hazard analysis and structural screening shall be repeated to
incorporatedesignprogressanddesignchanges.
6.2 Evaluation of PFCIs
6.2.1 Damage tolerance
a. EachPFCIshallbedamagetolerant.
b. ForthedamagetoleranceevaluationofPFCI,oneofthefollowingdesign
principlesshallbeusedinconformancewith
6.3:
⎯ Safelife,or
⎯ Fail‐safe,or
⎯ Low‐riskfracture
NOTE1 An overview of the fracture control evaluation
procedure, including damage tolerance design
approaches, classification of Potential Fracture
Critical Items and the relevant documentation is
illustratedin
Figure6‐1.
NOTE2 Another way to implement damage tolerance is
containment. Containment verification is
considered a fracture control activity (see clause
6.3.4). The container (or restraint) is a PFCI (see
6.1f).Contained (or restrained) items are however
notconsideredPFCI(see
Figure5‐1).
ECSS‐E‐ST‐32‐01CRev.1
6March2009
29
Figure6‐1:Fracturecontrolevaluationprocedures
ECSS‐E‐ST‐32‐01CRev.1
6March2009
30
6.2.2 Fracture critical item classification
a. Thefollowingitemsshallbeclassifiedasfracturecriticalitem(FCI):
1. Composite, bonded, sandwich or other non‐metallic PFCI, unless
failsafe,low‐riskfractureorcontained.
2. Metallic PFCI which require NDI better than standard NDI, as
specifiedinclause
10.3.
3. Pressure vessels in conformance with clause
8.2.2, or pressurised
structuresspecifiedfracturecriticalinclause
8.2.3.
4. PFCIwhichrequireperiodicre‐inspectionorreplacementinorder
toachievetherequiredlife.
NOTE1 Such items are called fracture limited‐life items
(FLLI)asasubsetofFCI.
NOTE2 Having FLLI is not always desirable from
programmaticconsiderations.
5. Rotatingmachineryasspecifiedinclause
3.2.35.
6.3 Compliance procedures
6.3.1 General
a. TheverificationofPFCIsshallbedonebyanalysisorbytestorboth.
NOTE Forvariousitemsspecialcomplianceprocedure
requirementsarespecifiedinclause
8.
b. The methodology applied for evaluation by test shall be subject to
customerapproval.
NOTE Customer approval is specified, because
evaluation by test is not specified to the same
level of detail than evaluation by analysis.
Evaluation by test is similar to evaluation by
analysis, where appropriate and not
specified
otherwise.
6.3.2 Safe life items
a. The evaluation procedure for a PFCI considered as a safelife item shall
beinconformancewith
Figure6‐3,formetallicitems,andFigure6‐4,for
composite,bondedandsandwichitems.
b. Except where it is explicitly specified otherwise, the initial crack or
damagesizeusedfortheverification(byanalysisortest)ofsafelifeitems
shallbedetectableby theappliedNDIwithatleast90%probabilityand
95%confidence.
c.
For metallic materials, the worst crack‐like defect in the part shall not
grow to such an extent that the minimum specified performance is no
ECSS‐E‐ST‐32‐01CRev.1
6March2009
31
longer assured within a specified safe life interval, using a design life
factorofatleastfour(4).
NOTE For example, minimum specified performance
can be the limit‐load capability (no failure or
burst or excessive deformation) or no‐leak,
dependingonthehazardtobeprevented.
d. Formetallic
materialsthemaximumsustainedstress‐intensityfactorKmax,
shall not exceed the threshold stress‐intensity factor for stress‐corrosion
crackingK
ISCC.
e. Forcomposite,bondedandsandwichitems,theworstdamageinthepart
shall not grow within a safe life interval, using a design life factor of 1
and a load enhancement factor of 1,15, after which the structure is still
abletoassureultimateloadcapability.
f. For limited
life items, a reduced service life shall be verified, which
allowsre‐inspectionorreplacementoftheitemswhen:
1. Theanalyticallifeislessthan2flights,formannedShuttle‐mission.
NOTE This is to allowfor a potential aborted mission
andsubsequentreflight.
2. Theanalyticallifeis
lessthanoneflight,foranyothercase.
g. Formetallicmaterials,safelifeanalysisshallbeperformedasspecifiedin
clause
7.
h. Safe life items made of non‐metallic materials, other than composite,
bondedandsandwichitems,shallbeinconformancewith
8.5and8.7.
6.3.3 Fail-safe items
a. TheevaluationprocedureforaPFCIconsideredasfail‐safeitemshallbe
asspecifiedin
Figure6‐4.
b. The structure remaining after failure of any element of the PFCI shall
sustain the limit loads with a safety factor of 1,0 for metallic and glass
itemsor1,15forcomposite,bondedandsandwichitems,without losing
minimumspecifiedperformance.
NOTE Minimum specified performance includes
prevention
oflargescaleyielding.
c. The failure of the item shall not result in the release of any part or
fragmentwhichcancreateacatastrophicorcriticalhazard.
NOTE For payloads on the NSTS or ISS, including
transportation events to ISS, as minimum the
massandmomentumlimitsdefined
in6.1eare
used.Moreingeneral,themaximumacceptable
massandvelocityofreleaseditemsisbasedon
theresultsofthehazardanalysis.
d. For metallic parts the fatigue life of the remaining structure shall be
evaluatedbylineardamageaccumulationrule(Minerʹsrule).
ECSS‐E‐ST‐32‐01CRev.1
6March2009
32
e. Formetallicparts,meanfatiguelifematerialcharacteristicsandadesign
lifefactorofatleastfour(4)shallbeused.
f. For composite, bonded andsandwich parts the fatigue assessmentshall
be performed using the mean fatigue life material characteristics, a
designlifefactorof1andaload
enhancementfactorof1,15.
g. In the case that no fatigue data are available, the fatigue analysis for
metallic parts may be replaced by a crack growth analysis using an
equivalentinitialcracksize ofa=c=0,125mm(corner or surfacecrack),
anddemonstratingnofailureafter
four(4)timestheservicelife.
h. For limited life items, a reduced service life shall be verified, which
allowsreplacementoftheitemswhen:
1. Lessthan2flightlivesremain,formannedShuttle‐mission.
NOTE This is to allowfor a potential aborted mission
andsubsequentre‐launch.
2. Lessthanoneflightliferemains,foranyothercase.
i. Fail‐safe items made of non‐metallic materials, other than composite,
bonded,sandwichandglassitems,shallbeinconformancewith
8.5.
6.3.4 Contained items
a. It shall be verified by analysis or test that the release of any loose item
whichcancreateacatastrophicorcriticalhazardiseffectivelyprevented
byanenclosure,protectivecoverorrestrainingelement.
NOTE Successfulcontainment verification implies not
to consider the contained items as PFCI. The
containing
orrestrainingelementsarePFCI(see
6.1).
b. For payloadsof the NASASTS or ISS, it shall be verified by analysis or
test that any loose item exceeding the allowable mass defined in clause
6.1e is prevented from being released into the cargo bay or crew
compartments.
c. For metallic enclosures, it shall be verified that the loose item does not
penetrateorfracturetheenclosurewithasafetyfactorof1,5onitskinetic
energy.
d. For composite, bonded and sandwich enclosures, it shall
be verified by
test(oranalysissupportedbytest)thattheloosepartdoesnotpenetrate
orfracturetheenclosurewithasafetyfactorof1,5onitskineticenergy.
e. Composite,bondedandsandwichenclosuresshallnotbefracturecritical
in conformance with clause
6.2.2, for reasons such as providinga single
pointoffailuresupportthatcancreateacatastrophicorcriticalhazardif
theenclosurefailed.
f. Engineeringjudgmentsupportedbydocumentedtechnicalrationalemay
be used when it is obvious that an enclosure, a barrier, or a restraint
preventsthepartfrom
escaping.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
33
NOTE Examplesofsuchenclosuresthathaveobvious
containment capability include metallic boxes
containingcloselypackedelectronics,detectors,
cameras, and electric motors; pumps and
gearboxes having conventional housings; and
shrouded or enclosed fans not exceeding
200mm in diameter and an 8000 revolutions
perminute(rpm)speed.
g. When
enclosuresaredesignedto be openedthe closure devicesshall be
single failure tolerant against failure to close if they are required to be
closedagaintoestablishcontainmentforalaterphaseofthemission.
6.3.5 Low-risk fracture items
6.3.5.1 General
a. Metallic low‐riskfracture items shall be in conformance with 6.3.5.2 and
6.3.5.3.
b. Composite, bonded and sandwich low‐riskfracture items shall be in
conformancewith
8.4.4.3.
6.3.5.2 Limitations on applicability for metallic parts
a. ThefollowingPFCIshallnotbeacceptedaslowriskfractureitems:
1. Pressure shells of human‐tended modules or personnel
compartments.
2. Pressurevessels.
3. Pressurized components in a pressurized system containing a
hazardousfluid.
4. High‐energyorhighmomentumrotatingmachinery.
5. Fasteners.
b. Themaximumtensile
stressbasedonnetcross‐sectionalareainthepart
at limit load shall be no greater than 30 percent of the ultimate tensile
strengthforthemetalused.
c. The use of low‐riskfracture classification shall be agreed with the
customer.
6.3.5.3 Inherent assurance against catastrophic or critical
failure from a flaw for metallic parts
6.3.5.3.1 Remote possibility of significant crack-like defect
a. Thefollowingcriteriashallbemet:
1. Low‐riskfracture items are fabricated from a well‐characterized
metal, procured in conformance with an aerospace standard or
equivalent standard approved by the customer, which is selected
from Table 5‐1 (Alloys with high resistance to stress‐corrosion
ECSS‐E‐ST‐32‐01CRev.1
6March2009
34
cracking) of ECSS‐Q‐ST‐70‐36 and therefore not sensitiveto stress
corrosion cracking in environmental conditions addressed by
ECSS‐Q‐ST‐70‐36.
2. Low‐riskfractureitemsarenotfabricatedusingaprocessthathas
a recognized risk of causing significantcrack‐like defects, such as
welding, forging,
casting, or quenching heat treatment (for
materialssusceptibletocrackingduringheattreatmentquenching)
unless specific NDI or testing, which has been approved by the
customer,isappliedtosufficientlyscreenfordefects.
NOTE1 It can be assumed that significant crack‐like
defectsdonotoccurduringmachiningof
sheet,
bar, and plateproductsfrom materials that are
known to have good machinability properties,
do not have low fracture toughness (i.e. when
the ratio K
Ic/Fty<1,66√mm; for steel bolts with
unknown K
Ic, low fracture toughness is
assumed when F
tu>1240MPa), and are metals
or alloys produced in conformance with
aerospace specifications and standards or
equivalentgradespecifications.
NOTE2 Low‐riskfracture items meet inspection
standardsconsistentwithaerospacepracticesto
ensure aerospace‐quality flight hardware. This
includesrawmaterialinspection.
3. Low‐riskfracture items receive
visual inspection of 100% of the
surfaceofthefinishedpart.
4. Low‐riskfractureitemsareinspectedattheindividualpartlevel
NOTE Thisistoassuremaximumaccessibility.
5. Low‐riskfracture items are rejected in case of detected surface
damagethatcanaffectpartlife.
6.3.5.3.2 Remote possibility of significant crack growth
a. Oneofthefollowingcriteriashallbemet:
⎯ Low‐riskfracture items are not subjected to fatigue loading
beyond acceptance or normal protoflight testing (if any),
transportation, and one mission (including a potential aborted
mission),or
⎯ Low‐riskfractureitemsareshowntopossessacceptableresistance
tocrackgrowthfrompotentialinitialdefectscausedbymachining,
assembly, and handling, by demonstrating that assumed initial
surface cracks of 3mm depth and 6mm length and corner cracks
of3mmradiusfromholesandedgesdonot
growtofailureinless
thanfourcompleteservicelifetimes.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
35
Yes
Rerunfractureanalysiswithimproved
ins
p
ection,inconformancewithclause7
Redesign
Fracturelimited‐lifeitem
Fracture–criticalitem
Itemnotfracture–
critical**,but
remainsaPFCI
Yes
Yes
Yes
No
No
No
No
No
Calculateanalyticallifeinconformancewithclause7
Yes
Isanalyticallife
>fourtimesreduced*
servicelife?
Isimproved
inspection
possible?
Isacceptance
ofthisitemappropriate
bysystemprogrammatics?
Isanalyticallife
>fourtimesservice
life?
Safelifeitem
Canitembeverified
byprooftestonly?
(see8.2.4.b)
Yes
Note:Includingmetalmatrixcompositesreinforcedbyparticlesorwhiskers.
Legend
* Incl.min.2flightsformanned
Shuttle‐missionpayloads
**Unlessfracturecriticalforanother
reason(see6.2.2)
> greaterthan
Setinitialdefectsizeinconformacewithstandard
(seeclause10.4.2.1)
No
Isanalyticallife
>fourtimes
servicelife?
Figure6‐2:Safelifeitemevaluationprocedureformetallicmaterials
ECSS‐E‐ST‐32‐01CRev.1
6March2009
36
Figure6‐3:Safelifeitemevaluationprocedureforcomposite,bondedand
sandwichitems
ECSS‐E‐ST‐32‐01CRev.1
6March2009
37
Fail–safe item
Yes
No
Is acceptance of
this item appropriate by
system program-
matics ?
Identify all load paths
Analyse the consequences of the loss of the individual members and
identify the worst case
Calculate the new stress/load
Fracture limited-life Item Fracture–critical item
The item is not fail–
safe. Redesign or evaluate as
sa
f
e
lif
e
i
te
m
Item is not
fracture critical,
but verified as
fail-safe PFCI
Can the remaining
structure sustain limit
load x SF (1)?
No
No
No
No
No
No
No
No
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Legend
* Incl. min. 2 flights for Shuttle-mission payloads
> greater than
Fatigue analysis
Is potential
redundancy
provided ?
Can an item with
more than the allowable
mass become loose ?
See 6.1
Is an increase in
load/stresses to be expected ?
e.g. caused by changed dynamic
behaviour due to the failure of
any of the individual
members
Is analytical life
> four times service
life ?
Is analytical life
> four times reduced*
service life ?
Is the item
contained ?
Is analytical life
> 1 time service
life with load
enhancement
factor of 1.15?
Yes
No
(1) SF=1.00 for metallic parts
SF=1.15 for composite parts
Is it a composite,
bonded or
sandwich item?
Figure6‐4:Evaluationprocedureforfail‐safeitems
ECSS‐E‐ST‐32‐01CRev.1
6March2009
38
6.4 Documentation requirements
6.4.1 Fracture control plan
a. Afracturecontrolplanshallbeprovidedinconformancewithclause5.2.
6.4.2 Lists
a. APFCIL, FCILandFLLILshallbeprovidedin conformancewithECSS‐
E‐ST‐32‘Fracturecontrolitemslists(PFCIL,FCILandFLLIL)‐DRD’
NOTE1 The potential fracture‐critical item list (PFCIL) is
compiled from the results of the fracture control
screening.
NOTE2 The fracture‐critical item list
(FCIL) includes the
sameinformationasthePFCILforeachFCI,andin
addition specifies a reference to the document
which shows for each item the fracture analysis
and/ortestresultsandtheanalyticallife.
NOTE3 The fracture limited‐life item list (FLLIL) includes
the same information as the
FCIL for each FLLI,
andinadditionspecifytheinspectionmethodand
period, and identifies the maintenance manual in
whichinspectionproceduresaredefined.
NOTE4 The above three lists can be reported in one
document.
6.4.3 Analysis and test documents
a. The analysis of all PFCIs, FCIs, contained and restrained items shall be
documented in a fracture control analysis report in conformance with
ECSS‐E‐ST‐32‘Fracturecontrolanalysis(FCA)‐DRD’.
b. When testing is used in addition to analysis of PFCIs, FCIs, contained
and restrained items, the test method
and test results shall be
documented in test plans, specifications, procedures and reports in
conformancewith:
1. ECSS‐E‐ST‐10‐02‘Verificationplan‐DRD’,
2. ECSS‐E‐ST‐10‐03‘Testspecification(TSPE)‐DRD’,
3. ECSS‐E‐ST‐10‐03‘Testprocedure(TPRO)‐DRD’,
4. ECSS‐E‐ST‐10‐
02‘Testreport(TRPT)‐DRD’.
NOTE The “Verification plan” can be limited to a
“Testplan”.
6.4.4 Fracture control summary report
a. A fracture control summary report shall be provided with each
deliverableflighthardwareitem.
b. Thefracturecontrolsummaryreportshallcontainthefollowing:
ECSS‐E‐ST‐32‐01CRev.1
6March2009
39
1. SummaryofidentifiedPFCI,FCI,FLLIandappliedNDImethods,
withspecificreferencetolowriskfracturePFCI,pressurizedPFCI,
safe life fasteners, composite PFCI, bonded PFCI, sandwich PFCI,
glass and other shatterable/brittle PFCI, other non‐metallic PFCI,
anddetecteddefectsthatremaininPFCI.
2. A summary discussion of
alternative approaches or specialised
assessmentappliedandtestsperformed.
3. Astatement that inspectionsor tests specified for fracture control
were,infact,applied in conformancewithrequirements,andthat
theproperuseoftheapprovedmaterialshasbeenverified.
4. A statement that hardware configuration of PFCI and their
assemblieshasbeenphysicallyverified.
5. Referencestosupportingdocumentation.
NOTE Forexample,analysisreports,testreports,NDI
reports, structural screening results and
associatedlists.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
40
7
Fracture mechanics analysis
7.1 General
a. Fracture mechanics analysis shall be performed to determine the
analyticallifeofasafelifemetallicitem.
b. The following data shall be made available in order to enable crack
growthpredictionandcriticalcrack‐sizecalculation:
1. Stressdistribution
2. Loadspectra
3. Materialproperties
4. Initialcracksize
5. Stressintensityfactorsolutions.
c. For the fracture mechanics analysis, the latest version of the software
packageESACRACKmaybeused.
NOTE1 Additional information on this software package
can be found in
Annex A, which also addresses
someofthelimitationsofthissoftware.
NOTE2 In general, existing fracture control analysis isnot
updated for each new update of the ESACRACK
software.Updateoftheexistinganalysisusingthe
latestversion is normallyperformed, for example,
in cases where the analysis is used to support the
acceptance of detected defects (see
10.7), or in
specificcaseswherethereisaclearindicationthat
the existing analysis made with an older version
canbeinadequate.
d. Incaseswhere the latestversion ofthesoftware package
ESACRACK is
not used, the alternative methods used and their validation shall be
submittedtothecustomerforapprovalpriortotheiruse.
e. Afracturemechanicsanalysisshallincludethefollowingtwoitems:
1. Crack‐growthcalculationinconformancewith
7.2.
2. Criticalcrack‐sizecalculationsinconformancewith
7.3.
NOTE In most cases the fracture mechanics analysis
demonstratesamarginontherequiredlifetime
and crack size, based on initial crack sizes
ECSS‐E‐ST‐32‐01CRev.1
6March2009
41
defined for standard or special NDI. As
alternative, the critical (i.e., maximum) initial
defect(CID)sizeforwhichtheitemcansurvive
four times the required service life can be
calculated iteratively, after which it can be
verified by inspection that the probability of
havingcracks greaterthan or equalto
thissize
is sufficiently small. This CID approach is
specificallyappropriateforanalysisofcracksto
bescreenedbyprooftesting.TheCIDapproach
can require careful scrutiny of the validity of
the analysis, because it does not demonstrate
anymarginintheanalysisresults.
7.2 Analytical life prediction
7.2.1 Identification of all load events
a. Theservice‐lifeprofileoftheitemshallbedefinedinordertoidentifyall
cyclicandsustainedloadeventstobeincludedinthestressspectrum.
b. Allloadeventsexpectedfortheitemshallbeincludedintheservice‐life
profile.
NOTE Examples of load events expected
throughout
theservicelifeare:
• manufacturingandassembly;
• testing;
• pressurisationsonground
• handling,e.g.byadollyorahoist;
• transportationbyland,seaandair;
• ascent(launch);
• stay in orbit, including thermally induced
loadsandoperationalloads;
• descent(re‐entry);
• landing.
c. ForShuttlemissions,anabortedmissionandsubsequentreflightshallbe
includedintheservice‐lifeprofileoftheitem.
7.2.2 Identification of the most critical location
and orientation of the crack
a. Themostcriticallocationandorientationofthecrackontheitemshallbe
identifiedfortheanalysis.
b. To identify the most critical location, the following parameters shall be
considered:
ECSS‐E‐ST‐32‐01CRev.1
6March2009
42
1. Themaximumleveloflocalstress.
2. Therangeofcyclingstress.
3. Locationswithhighstressesorstressintensities.
4. Areaswherematerialfracturepropertiescanbelow.
5. Stresseswhich,combinedwiththeenvironment,resultinreduced
fractureresistance.
6. Stress‐concentration,environmentalandfrettingeffects.
7. Severity
ofstressspectrum
c. Incaseswherethemostcriticallocationororientationoftheinitialcrack
isnotobvious, theanalysisshallconsidera sufficientnumberoflocations
andorientations.
7.2.3 Derivation of stresses for the critical
location
a. Forthe criticallocation,as identified in 7.2.2,the principal stresses shall
be derived which are caused by the load components which act on the
itemduringtheloadeventsidentifiedin
7.2.1.
NOTE For example, principal stresses due to
translational and rotational accelerations,
pressure, temperature and loads induced by
adjacentstructure.
b. The stresses shall be derived for the worst credible combination of all
influencingaspects
NOTE For example, influencing aspects to be
considered include: geometrical discontinuities
and imperfections, manufacturing defects,
residualstresses
7.2.4 Derivation of the stress spectrum
a. A stress spectrum shall be derived for the critical location identified in
7.2.2,basedontheloadeventsidentifiedin7.2.1andthestressesderived
in
7.2.3.
b. Inthestressspectrum, the number ofcyclesineach step, andtheupper
andlowervaluesofthestresscomponentsineachstepshallbedefined.
NOTE For example, stress components are remote
tension stress, remote bending stress and pin
bearingstress.
c. Thestressspectrumshall
beprovidedtothecustomerforapproval.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
43
7.2.5 Derivation of material data
a. Materialpropertiesusedintheanalyticalevaluationshallbevalidforthe
anticipated environment, grain direction, material thickness, specimen
widthandloadratio(R).
NOTE Where the operational temperature range
overlaps with the ductile to brittle fracture
transition temperature range of the material,
the variation of material behaviour as
function
of temperature effect over this temperature
rangeistakenintoaccountintheanalysis.
b. Meanvaluesofcrackgrowthrate(da/dN,da/dt)shallbeused.
c. Meanvalueofthresholdstressintensityrange(ΔK
th)shallbeused.
d. Lowerboundaryvaluesshallbeused,for:
1. Critical stress intensity factor, K
IC or KC (fracture toughness), and
otherresidualstrengthrelatedproperties(e.g.flowstress).
2. Environmentallycontrolledthresholdstressintensityforsustained
loading,K
ISCC.
e. Lowerboundaryvaluesshallbederivedasfollows:
1. values with a 90% probability and 95% confidence level of being
exceeded(B‐valueasdefinedinDOT/FAA/AR‐MMPDS),or
2. incaseswhereinsufficienttestdataareavailable:70%ofthemean
values.
f. Forthederivationof
theproofloadingtobeappliedforidentificationof
initialcracksizes,upperboundaryvalues,definedas1,3timesthemean
values,shallbeusedforthecriticalstressintensityfactor,K
ICorKC.
g. Forthederivationoftheproofloadingtobeappliedforidentificationof
initial crack sizes, in the case of through cracks, and in case the elastic‐
plastic approach is applicable, a factor of 1,3 shall be applied to the
completeK‐Rcurve,oranequivalentfactor1,69
iftheJ‐Rcurveisused.
h. ForthosematerialswhereasignificantreductionoftheK
Cforthinsheets
isobserved,thereducedvalueshallbeusedintheanalysis.
NOTE This reduction of fracture toughness is not
automaticallyaccountedforintheESACRACK
software.
i. Mechanical testing of metallic materials shall be performed in
conformancewithECSS‐Q‐ST‐70‐45.
7.2.6 Identification of the initial crack size and
shape
a. Theinitialcrackshapeshallbeidentifiedbyconsideringthegeometryof
the item and the critical location, in line with
Figure 10‐1, Figure 10‐2,
and
Figure10‐3.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
44
b. Theinitialcracksizes used in theanalysisshallbe defined based onthe
inspectionlevelorproofloadscreeningusedfortheitem.
NOTE Seealsoclause
10.
c. Crackaspectratios(a/c)of0,2and1,0shallbeconsideredintheanalysis.
d. Aninitialcracksizeasspecifiedin
7.2.6eshallbeassumedif:
1. A large number of holes are drilled or the automatic hole
preparationisusedandNDIofholescannotbeperformed.
2. The load is not transmitted through a single hole, such as for a
fitting.
3. Theholesarenotpunched.
4. Thematerial
isnotpronetocrackingduringmachining.
5. NDIisperformedpriortothemachiningoftheholes.
6. No heat treatment or potentially crack forming fabrication
processesareperformedsubsequenttoNDI.
7. Approvalisobtainedfromthecustomer.
e. For automatic hole preparation indicated in
7.2.6d, an initial crack size
shallbeassumedbasedontheworstofthefollowing:
1. The initial crack size determined by the NDI performed before
holepreparation,or
2. Thepotentialdamagefromholepreparationoperations,asdefined
below:
(a) Fordrilledholeswithdrivenrivets,theassumeddefectdue
to potential damage is a 0,13 mm length crack through the
thicknessatonesideofthehole.
(b) For fastener holes other than those for driven rivets, where
the material thickness is equal to or less than 1,3 mm, the
assumed fabrication defect due to potential damage is a
1,3mmlengthcrackthroughthethicknessatonesideofthe
hole.
(c) For fastener holes other than those for driven rivets, where
the thickness is greater than 1,3 mm, the initial crack size
due to potential damage is a 1,3 mm radius corner crackat
onesideofthehole.
7.2.7 Identification of an applicable stress
intensity factor solution
a. Stress intensity factor solutions for the relevant item geometry, crack
shape,cracksizeandloadingshallbeused.
b. Local stresses caused by stress concentrations shall be included in the
applied stress spectrum if their effect is not fully included in the used
stressintensityfactorsolutionsusedin
7.2.7a.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
45
7.2.8 Performance of crack growth calculations
a. Crack growth calculations shall be performed using the variables as
definedin
7.2.1to7.2.7.
b. The analysis methodology used shall account for the two‐dimensional
growthcharacteristicsofcracks,multipleloadingeventswithvariationin
amplitude, excursions between mean stress levels and negative stress
ratios.
c. Thecompleteloadingspectrumshallbeanalyticallyimposedatleastfour
(4)timesinsequence,oneafteranother.
d. Theloadingspectrumshallbeanenvelopeofallthecredibleloadevents
thatcanbeencounteredduringthedesignlife.
e. Growthofcracksbeyondthecriticalcracksizeshallnotbeconsideredin
thecrackgrowthanalysis.
f. In cases where leakage is hazardous, growth of cracks
through the
thicknessshallnotbeconsideredinthecrackgrowthanalysis.
g. Beneficial retardation effects on crack growth rates from variable
amplitude spectrum loading shall not be considered without the
approvalofthecustomer.
h. For components where a crack grows into a hole, the analysis shall
assumethatthe
crackpropagationisnotarrestedorretardedbythehole.
i. Forcyclicplasticdeformation,EPFMcrack‐growthmethodologyshallbe
used,whichissubjecttocustomerapproval.
j. For manufacturing steps, which can cause crack extension without the
possibilityofsubsequentNDIthemaximumpossiblecrackgrowthshall
be
consideredinthesafelifecalculation.
NOTE For example, the autofrettage pressure cycle
during manufacturing of a COPV which can
lead to crack growth by linear or non‐linear
material behaviour. Especially the non‐linear
material behaviour can lead to stable crack
growth (ductile tearing) which can be
considerablyunderestimated.
k. Shear (i.e.mode IIormodeIII) loadingof the crackshallbeconsidered,
usingananalysismethodagreedwiththecustomer.
7.3 Critical crack-size calculation
a. Thecriticalcrack‐size(ac)shallbecalculatedbymeansofLEFM:
∑
=
2
2
)(
)(
ii
c
c
SF
K
a
π
where S
i are the maximum specified stresses and Fi are the stress
intensitymagnificationfactorsforthedifferentloadcases(whichdepend
onthecracksizea)andK
Cisthecriticalstressintensityfactor.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
46
NOTE The maximum specified load is in many cases
the limit load, but sometimes higher than the
limitload(e.g.fordetecteddefects, composites
andglassitems).
b. InthosecasesoutsidetherangeofvalidityofLEFM,thecriticalcracksize
shall be evaluated by appropriate EPFM methods or
by a structure
representativetest.
NOTE1 This applies also to crack extension under non‐
linear material behaviour. For example ductile
tearing.
NOTE2 The consideration of structure representative
conditions is of great importance in the case of
EPFM, where for example stress multi‐axiality
effectscansignificantlyinfluencetheresults
ofthe
analysisortest.
NOTE3 In the NASGRO module of the ESACRACK
softwareasimplifiedverificationcanbeperformed
to ensure that no premature failure under elastic‐
plastic conditions occurs, based on comparison of
the so‐called net‐section stress and flow stress. In
most of the common
applications this can be
considered as adequate. For e.g. verification of
highly critical, highly stressed (e.g. pressure
vessels, launcher tanks) applications and detected
defects it can be necessary to performed more
advancedEPFManalysisortesting.
c. Thematerialpropertiesusedforthecriticalcracksizecalculationshallbe
inconformance
with7.2.5.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
47
8
Special requirements
8.1 Introduction
Exceptwhereitisexplicitlyspecifiedthattheyreplacerequirements,thesespecial
requirementsapplyinadditiontothosespecifiedinclauses
4to7and9to11.
8.2 Pressurized hardware
8.2.1 General
a. All pressurized systems in NSTS and ISS payloads shall be in
conformance with the requirements of NSTS 1700.7 (incl. ISS
Addendum).
NOTE1 Pressurized hardware (including pressure vessels,
pressurized structures, pressure components, and
special pressurized equipment) comply with
ECSS‐E‐ST‐32‐02.
NOTE2 For the attachments of pressurized
hardware,
which are not part of the pressurized shell, no
special requirements are specified in
8.2. They
follow the normal rules of this standard (e.g. be
verified safe life or fail safe) to prevent
catastrophicorcriticalhazards.
8.2.2 Pressure vessels
8.2.2.1 Overview
Pressurevesselsareclassifiedasfracturecritical,inconformancewith6.2.2.
Pressure vessels are subject to the implementation of fracture critical item
tracking,controlanddocumentationprocedures,inconformancewith
10.6.
8.2.2.2 Requirements
a. Inadditiontothemaximumdesignpressure(MDP),asdefinedinclause
3.1 of this standard, all external loads shall be included in the fracture
controlverification.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
48
NOTE Example of external loads are vehicle
accelerationloads.
b. Fracturemechanics verification of metallic pressure vessels andmetallic
linersofCOPVshall,whenrequiredinconformancewithECSS‐E‐ST‐32‐
02,beperformedinconformancewith
Figure8‐1andclauses6.3.2and7.
c. Theverificationof
8.2.2.2b,shalldemonstratesafelifeagainsthazardous
leakageandburst.
d. For non‐hazardous leak before burst (NHLBB) vessels, all areas which
cannotbeverifiedLBB,shallbeverifiedassafelife.
NOTE For example, at load introduction (e.g. boss
area) and in other thick‐walled regions, when
agreedwith
thecustomer.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
49
Is vessel life
before leak or burst
> four times
service life?
Is the item
non-hazardous leak
before burst?
Yes No
Is improved inspection
possible?
Legend
* Incl. min. two flights for Shuttle-mission
payloads (see 6.3.3.h.1)
> greater than
No
No
Proof
Other NDI
Compute analytical life
according to clause 7 using
initial crack size conform
standard NDI
Is crack detection
to be performed by
proof test or other
NDI?
Compute analytical life
according to clause 7 using the
initial crack size to be screened
by proof test
Is vessel life
before leak or burst
> four times service
life?
Compute analytical life
according to clause 7 using
initial crack size
conform improved inspection
Is vessel life
before leak or burst
> four times reduced*
service life?
Fracture limited-life
item
Yes
Yes
No
Yes
Redesign
Fracture–critical item
Yes
No
Pressure vessel
Fracture-critical item
Yes
No
Is acceptance of
this FLLI acceptable by
system programmatics?
Figure8‐1:Procedureformetallicpressurevesselandmetalliclinerevaluation
ECSS‐E‐ST‐32‐01CRev.1
6March2009
50
8.2.3 Pressurized structures
8.2.3.1 General
a. Apressurizedstructureshallbeclassifiedasafracturecriticalitem,when
anyofthefollowingapplies:
1. Itisthepressureshellofamannedmodule.
2. It contains stored energy of 19310joules (14240foot‐pounds) or
more, the amount being based on the adiabatic expansion of a
perfectgas.
3. Itcontainsagasorliquidwhichcreatesahazardifreleased.
4. Itis subjected to a maximum design pressure (MDP)greater than
0,69MPa(100psi).
b. Pressurized structures shall be in conformance with ECSS‐E‐ST‐32‐02,
clause4.4.
c. Pressurized structures conforming
to ECSS‐E‐ST‐32‐02 which have
composite overwrap or are fully made of composite shall not be
implementedforSTSorISSmissionswithoutapprovalofthecustomer.
NOTE For such pressurized structures, see
clauses4.4.2,4.4.3and4.4.4ofECSS‐E‐ST‐32‐02.
d. Fracture mechanics
verification of metallic pressurized structures and
metallic liners of overwrapped pressurized structures shall, when
required in conformance with
8.2.3.1b, be performed in conformance
withclauses
6.3.2and7ofthisStandard.
e. Theverificationof
8.2.3.1d,shalldemonstratesafelifeagainsthazardous
leakageandburst.
8.2.3.2 Manned pressurized structures
a. The design of manned pressurized structures shall be in conformance
with the LBB criterion, in conformancewith ECSS‐E‐ST‐32‐02, clause on
“Failuremodedemonstration”.
b. Thedesignshallbesafelifetoleakage.
8.2.4 Pressure components
a. For pressure components, the complete pressure system shall be proof
tested and leak checked in addition to an acceptance proof test of the
individualitems.
b. Safe lifeanalysismay be omitted if the item is proof tested to a level of
1,5 or more times the design limit load,
including MDP and vehicle
accelerations.
c. All fusion joints shall be 100% inspected by means of a qualified NDI
method.
d. Concurrence of the customer shall be obtained where 100% NDI is not
consideredpracticable.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
51
8.2.5 Low risk sealed containers
a. Additional fracture assessment need not be performed on sealed
containersmeetingthefollowingcriteria:
1. Thecontainerisnotpartofasystemwithapressuresourceandis
individuallysealed.
2. Leakage of the contained gas does not result in a catastrophic
hazardandthepressureshellisverified
leakbeforeburst(LBB).
3. The container or housing is made from a conventional alloy of
steel,aluminium,nickel,copperortitanium.
4. TheMDPdoesnotexceed0,15MPa.
5. The free volume within the container does not exceed 0,051m
3
(1,8cubic feet) at 0,15MPa (22psi) or 0,076m
3
(2,7cubic feet) at
0,10MPa (15psi), or any pressure‐volume combination not
exceeding a stored energy potential of 19310joules (14240foot‐
pounds).
b. ForsealedcontainerswithaMDPhigherthan0,15MPa(22psi),butless
than0,69MPa(15psi),andapotentialenergynotexceeding
19310joules
(14240foot‐pounds) meeting criteria
8.2.5a.1, 8.2.5a.2 and 8.2.5a.3,
additional fracture assessment need not be performed if the following
apply:
1. the minimum factor of safety is 2,5×MDP (verified by stress
analysisortest),or
2. thecontainerisproof‐testedtoaminimumof1,5×MDP
c. All sealed containers shall be capable of sustaining
0,10MPa (15psi)
pressuredifferencewithaminimumsafetyfactorof1,5.
8.2.6 Hazardous fluid containers
a. Subject to approval of the customer, hazardous fluid containers shall
complywiththefollowing:
1. Haveastoredenergyoflessthan19310Joules(14240foot‐pounds)
withaninternalpressureoflessthan0,69MPa(100psi).
2. Haveaminimumsafetyfactorof2,5timesMDP.
3. Be
in conformance with the fracture control requirements for
pressurecomponentsspecifiedinclause
8.2.4.
4. When agreed with the customer not to use a proof test to a
minimumfactorof1,5,safe‐lifecanbeassuredbyNDIapplication
andcrackgrowthanalysis.
5. Integrityagainstleakageisverifiedbytestataminimumpressure
of1,0timesMDP.
b. Ifprovision
8.2.6aisnotmet,hazardousfluidcontainersshall:
1. Havesafe‐lifeagainstruptureandleakage.
2. Be treated and certified the same as pressure vessels when the
containedfluidhasadeltapressuregreaterthanoneatmosphere.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
52
8.3 Welds
8.3.1 Nomenclature
a. Thestandardisednomenclatureforthedifferenttypesofweldsandtheir
characteristics, including imperfections, as presented in ISO17659 and
ENISO6520‐1shallbeused.
8.3.2 Safe life analysis of welds
a. For welds, the fracture mechanics analysis shall be performed with the
aid of the material properties of the weldments, including weldment
repairs.
b. When the material properties specified in
8.3.2a are not available, they
shallbederivedbymeansofatestprogrammecovering:
1. Ultimate and yield strength for all welding conditions used,
including mechanical properties (as in
8.3.2a) in the presence of
different misalignments, angles between joints or typical defects,
andtheirconsequences.
2. Fracture toughness K
C, stress‐corrosion cracking threshold KISCC,
andcrackpropagationparametersforeachtypeofthickness.
3. Young’smodulusforweldmaterial:
(a) Evaluated by test only in those cases, where a significant
amount of a second phase with a different modulus
comparedtothebasematerialappears.
(b) If the microstructure with respect to the different
phases
doesnotchange,thebasematerialYoung’smodulusapplies
alsoforweldmaterial.
c. The test programme specified in
8.3.2bshall be performed ona number
of specimens agreed with the customer, but not less than 5, in order to
permitastatisticalevaluationoffinalvalues.
d. The fracture mechanics assessment shall be performed under
considerationofanypotentialweldgeometricalimperfectionasfollows:
1. Inafirststep,
ascreeningoftheappliedweldprocessandmaterial
is performed to identify all potential weld geometrical
imperfections.
NOTE SeeENISO6520‐1
2. Acceptance limits for the identified geometrical imperfections are
determinedandincludedinthefracturemechanicsanalysis.
e. Any residual stresses, both in the weld and
in the heat‐affected zone,
shallbeusedinthesafelifeanalysis.
f. Except in the case specified in
8.3.2g, even though inspected for
embedded flaws and pores, the initial crack geometry for the analysis
ECSS‐E‐ST‐32‐01CRev.1
6March2009
53
shall always be assumed to be a surface part‐through‐crack or through‐
crack,asspecifiedinclause
10.
g. Embedded crack casesshallnotbeusedincases otherthan those where
NDI methods are used which enable the determination of the relative
distanceoftheembeddedflawtothesurface.
NOTE Forexample,embeddedcracks(see
Figure10‐1
geometry 6) can be used when ultrasonic
inspectionisapplied.
8.4 Composite, bonded and sandwich structures
8.4.1 General
a. PFCI made of fibre‐reinforced composite, including bonded joints,
sandwiches and potted inserts, which are classified safe life and which
are not low‐riskfracture items in conformance with
8.4.4.3, shall be
treatedasfracturecriticalitems.
b. All PFCI falling into the category fibre‐reinforced composites, bonded
andsandwichstructuresshallcomplywithclauses
8.4.2to8.4.4.
NOTE This includes adhesive bonds in metallic
structures.
c. Composite overwraps of COPV and other composite overwrapped
pressurizedhardwareshallbeinconformancewithclause
8.2andECSS‐
E‐ST‐32‐02,asminimum.
NOTE1 ThismeansthatthesecompositePFCIdonotneed
to be fully compliant with the detailed
requirementsofthisclause
8.4.
NOTE2 For the attachments of pressurized hardware,
which are not part of the pressurized shell, no
specialrequirementsarespecifiedin
8.2andECSS‐
E‐ST‐32‐02. Composite, bonded and sandwich
attachment hardware follows the rules of this
clause
8.4 to prevent catastrophic or critical
hazards.
8.4.2 Defect assessment
8.4.2.1 Manufacturing defects
a. A list of potential manufacturing defects, including their maximum
acceptable size (or ratio for porosity), shall be established, covering all
appliedmanufacturingprocesses.
NOTE For example, the following defects, depending
on the manufacturing process, can be
considered:
• Highporosityratio
ECSS‐E‐ST‐32‐01CRev.1
6March2009
54
• Delamination
• Fibremisalignment
• Cutorbrokenfibres
• Jointdebonding.
b. The maximum acceptable defect size (or ratio) considered in the
verificationshallbedetectablebytheappliedNDI,in conformancewith
10.3and10.5.
NOTE With approval of the customer, acceptable
defect size (or ratio) consistent with the
manufacturing process (including process
control) are sometimes used in the fracture
control verification for certain manufacturing
defecttypes,insteadofdefectsbasedonNDI.
c. The effects of the potential manufacturing defects on the structural
integrityshallbeestablished,documentedandverified.
NOTE Examples of such effects are strength, stability,
andfatigue.
d. Acceptance criteria based on a fracturecontrol methodology, as defined
inthisclause
8.4,shallbeestablishedforthosemanufacturingdefectsfor
which the effect is not already included in material properties used for
structuraldesignandqualification.
NOTE For example, in conformance with
8.4.2.1c and
8.4.2.1d porosity can be excluded from
verification by means of a fracture control
methodology, if the detectable ratio by means
ofNDI isfullyrepresentedinthe derivation of
strengthandfatigueallowables.
8.4.2.2 Mechanical damage
a. Mechanicaldamageshallbeconsideredinconformancewiththedamage
threatassessmentasspecifiedinclause
8.4.3
NOTE Forexample,thefollowingmechanicaldamage
due to events which can occur during the
servicelife,canbeconsidered:
• Impact
• Scratch
• Abrasion.
8.4.2.3 Defect assessment procedures
a. The following types of defects shall be included in the safe life
verificationinconformancewith
8.4.4.2:
1. Mechanicaldamageatthemaximumexpectedlevel,asspecifiedin
clause
8.4.4.2and8.4.3.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
55
2. Manufacturing defects at the maximum size (or ratio) in
conformance with applied inspection methods as specified in
clause
8.4.2.1.
3. Detecteddefectsinconformancewithclause
10.7.
b. For fail safe verification in conformance with
8.4.4.1, detected defects
shallbeincludedinconformancewithclause
10.7.
c. Low‐riskfracture verification in conformance with
8.4.4.3 shall consider
thedamageassociatedwiththevisualdamagethreshold(VDT)orlarger.
NOTE For detected defects in low‐riskfracture items,
seeclause
10.7.
8.4.3 Damage threat assessment
8.4.3.1 Introduction
Theobjectivesofthedamagethreatassessmentareto:
• Determine the upper level of mechanical damage which is taken into
accountinthesafelifeverification.
• Ensurethattheverificationoffail‐safeandlow‐riskfractureitemsisbased
on valid assumptions, i.e.: to consider only detected defects
for fail safe
items,andVDTforlow‐riskfractureitems.
Thedamagethreatassessmenttakesintoaccountdamageprotection,inspection
andindicationperformedthroughouttheservicelifeoftheitem.
The damagethreat assessment is also appliedto those safe life items screened
for manufacturing defects by proof testing,
in conformance with 8.4.4.2g, to
ensurethatnodetrimentaldamageoccursafterprooftesting.
8.4.3.2 Identification of potentially damaging events and
resulting mechanical damage
a. The events that can cause mechanical damage during the service life,
shall be identified and documented in the fracture control analysis
report.
NOTE1 Theservicelifeincludesthefollowingphases:
• Handling,
• Test,
• Transportation,
• In‐serviceuse,
• Maintenance,
• The manufacturing phase, which are not
coveredbyNDI.
NOTE2 Thefollowingareexamplesofcredibleevents:
• Tooldrop
• Bumpingorfallingduringhandling
ECSS‐E‐ST‐32‐01CRev.1
6March2009
56
• Scratchduringassembly.
b. For the events identified in
8.4.3.2a the type and maximum credible
magnitude of the associated threats to the integrity of the hardware
duringthoseeventsshallbeidentified.
NOTE Forexample,themagnitudeofthethreatcanbe
described by the energy at impact, the shape,
material and orientation of the impactor and
theworst
impactlocation.
c. The assessment shall include the potential consequences of impact of
items considered as low mass or low momentum (in conformance with
6.1), or due to items considered as contained or restrained (in
conformancewith
6.3.4),incasetheyarereleased.
d. For the type and maximum magnitude of the threat during each event
that can cause mechanical damage,as identified in
8.4.3.2a, 8.4.3.2b and
8.4.3.2c,theresultingmechanicaldamageshallbeidentifiedwithitstype
andsizeorlevel.
NOTE1 Typesof damageareforexample: impact damage
(including delamination, broken fibres and
perforation),scratch,andabrasion.
NOTE2 Damage size or level can be characterised, for
example,byenergylevelforimpact,or
depthand
lengthforascratch.
8.4.3.3 Mechanical damage protection
a. In the case where protective devices are used to reduce the effects of
events,toavoidsomeevents,ortoprotectthestructure,theeffectiveness
ofthedevicesshallbedemonstratedbytest.
8.4.3.4 Mechanical damage inspection and indicators
a. Close visual inspection shall be performed for each PFCI and FCI, just
beforeeachlaunchor just before closeoutof surrounding structureafter
whichmechanicaldamageisnolongercredible,asdeterminedin
8.4.3.2.
b. NDIshallmeettherequirementsofclause
10.3.
c. In case mechanical damage indicators are applied to provide positive
evidence of a mechanical damage event, their effectiveness shall be
demonstratedbytest.
8.4.4 Compliance procedures
8.4.4.1 Fail safe items
a. Afailsafeitemshall meetalltherequirementsforthefailsafeapproach
describedinclauses
6.2,6.3,and10.7.
b. Forafailsafeitemitshallbedemonstratedbytestoranalysissupported
by test that there is no unacceptable degradation (in conformance with
ECSS‐E‐ST‐32‐01CRev.1
6March2009
57
8.4.4.1a)ofthealternativeloadpath,duetocyclicloadsorenvironmental
effects.
NOTE No damage needs to be considered for the
alternative load path, unless detected defects
exist(seeclause
8.4.2.3).
c. A failsafe item shall be inspected at least by close visual inspection
covering hundred per cent of the item before each flight, in addition to
NDIduringmanufacturing.
8.4.4.2 Safe life items
a. Asafelifeitemshall meetallthe requirementsfor the safelifeapproach
describedinclauses
6.2,6.3,and10.7.
NOTE Seealso
Figure6‐3.
b. Fora safelifeitemthe requirementsof
8.4.4.2ashall besatisfiedby full‐
scale or sub‐scale tests complemented by coupon testing, or analysis
supportedbytestsrepresentativeofstructuraldetails.
c. Forasafelifeitemthetestsof
8.4.4.2bshallbeperformedinthepresence
of induced defects representative of manufacturing defects (in
conformancewith
8.4.2.1)andmechanicaldamageasdefinedin8.4.4.2d,
asspecifiedin
8.4.2.3.
NOTE The use of interlaminar fracture mechanics
analysisissubmittedtocustomerapprovaland
includes the successful demonstration of the
methodology by test on sub‐component or
component(structure)level.
d. Themostsevereofthefollowingmechanicaldamageshallbeconsidered
forverificationofsafelifeitems:
1.
The maximum size or level that can be induced, in conformance
with
8.4.3.2 and 8.4.3.3, and remain undetected, in conformance
with
8.4.3.4.
2. Mechanicaldamage resultingfrom impact energy associated with
thevisualdamagethreshold.
e. Forasafelifeitemthetestarticlesandtestsofthetestprogramof
8.4.4.2b
shallberepresentativeofmanufacturingprocess,environmentandloading
type(consideringlocalloadintroductionwhereapplicable)demonstrating
ultimateloadcapabilityandnogrowthofdefectsattheendofon e timethe
servicelifewithaloadenhancementfactor(LEF)of1,15.
NOTE Test articles can be flight representative
structural elements, (sub)components or full‐
scaleparts.
f. For a safelife item the test programme (including applied LEF and
fatiguespectrum)shallbeapprovedbythecustomer;
g. For a safelifeitem, a proof test for manufacturing defect screeningmay
beappliedwhen:
ECSS‐E‐ST‐32‐01CRev.1
6March2009
58
1. Itissubjectedtocustomerapproval.
2. Aprooftestfactorofatleast1,2isappliedtothelimitloads.
NOTE1 The effect of material degradation due to
environmental exposure is treated on a case by
casebasis.Itcanresultinahigherprooftestfactor,
which
isagreedwiththecustomer.
NOTE2 A large number of complicated load cases can be
necessary to ensure that all locations of the
structure are adequately screened for
manufacturing defects during the proof testing.
Simplificationof theproofloadcases canresultin
highertestloads,overdesignofthe
flightstructure
andincreasedriskoffailureduringthetest.
3. For multi‐mission hardware, the proof test is repeated between
flights.
4. The applied proof loads do not exceed 80% of the ultimate
strength.
5. PosttestNDIisappliedforallprooftestedcomposite,bondedand
sandwichparts.
NOTE Special problems can arise in certain instances
such as a region of high load transfer where
compliancewiththeprooftestrequirementsfor
the composite structure introduces local
yielding of the metal component. These are
treatedonacasebycasebasis.
8.4.4.3 Low-risk fracture items
a. A low‐riskfracture item shall not be a pressure vessel, high energy
rotating machinery, habitable module or otherwise fracture critical
pressurizedstructure,andnotcontainahazardousfluid.
b. For a low‐riskfracture item, the result of the damage threat assessment
shallbethat,asaresultof
damageinspectionandprotection,nodamage
largerthanthevisualdamagethresholdisexpected.
c. Alow‐riskfractureitemshallbeinspected,asaminimum,byclosevisual
inspection covering hundred per cent of the item before each flight, in
additiontoNDIduringmanufacturing.
d. A low‐risk
fracture item shall not include a single point failure bonded
area.
e. Foralow‐riskfractureitemthestrainatthelimitloadshallbebelowthe
damagetolerancethresholdstrain.
f. With approval of the customer, it may be considered that the strain is
below the damage tolerance threshold
strain without specific testing,
when:
ECSS‐E‐ST‐32‐01CRev.1
6March2009
59
1. Atthelimitloadthemaximumtensilestresses,takenintoaccount
the stress concentration factor, is lower than 40% of the material
ultimatecapability.
2. At the limit load the maximum compressive stresses, taken into
account the stress concentration factor, is lower than 25% of the
materialultimate
capability.
8.5 Non-metallic items other than composite, bonded,
sandwich and glass items
a. Potentialfracturecriticalitemsmadeofnon‐metallicmaterial,otherthan
thosecoveredbyclause
8.4(composite,bondedandsandwichitems)and
clause
8.7 (glass), which are safe life, shall be treated as fracture critical
items.
NOTE Forexample,ceramic,C/SiC,C/C.
b. FracturecontrolimplementationforPFCImade ofnon‐metallicmaterial
shallbesubjecttocustomerapproval.
c. An item shall not be accepted as a fail safe item unless it
meets the
followingtwoconditions:
1. Itmeetsalltherequirementsforthefailsafeapproachdescribedin
clauses
6.2and6.3.
2. It has been demonstrated that, for the item, there is no
unacceptabledegradationofthealternativeloadpath,duetocyclic
loadsorenvironmentaleffects.
d. An item shall not be accepted as a safe life item unless it meets the
followingtwoconditions:
1. It has been demonstrated
by fatigue analysis (accounting for the
effects of cyclic and sustained loading) supported by tests that,
during a time period of four times the service life, there is no
unacceptable degradation due to cyclic loads or environmental
effectsinthepresenceofinduceddefects,compatiblewithapplied
NDItechniques,using
representativecoupons.
NOTE Results of representative earlier tests can be
used to support the analysis, when approved
bythecustomer
2. Itundergoesaproof‐testofallflighthardwaretonotlessthanone
andtwotenth(1,2)timesthelimitload.
e. In those cases where problems arise
to fulfil the proof test requirement,
theseshallbetreatedonacasebycasebasis.
NOTE For example, the region of high load transfer
where compliance with the proof test
requirements for the non‐metallic structure
introducesyieldingofthemetalcomponent.
f. Test loads on the non‐metallic
item shall not exceed 80% percent of
ultimatestrength.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
60
8.6 Rotating machinery
a. Rotating machinery shall be proof (spin) tested and subjected to NDI
beforeandafterprooftesting.
b. The proof test factor shall be derived by means of fracture mechanics
analysis,butnotbelessthan1,1.
NOTE Rotating hardware not considered as rotating
machineryinconformancewith
3.2.35istreated
asanystructuralitem.
8.7 Glass components
a. Theverificationofallpotentialfracturecriticalglasscomponents,except
thoseverifiedasfail‐safeorcontained,shall includeananalysisofcrack
growth under conditions of the stresses and the environments
encounteredduringtheirservicelife.
b. A fracture mechanics analysis for potential sustained crack growth
(da/dt)shallbe
performedinconformancewithclauses7,8.7c,8.7d,8.7e
and
8.7fforeachsafelifeglassitem,inordertodemonstratethattheitem
sustains after four (4) times its service life at least one and four tenths
(1,4)timesthedesignlimitloadwithoutfracture.
c. The sustained crackgrowth analysis shall apply factors to the sustained
stressesofthe
stressspectrumasspecifiedinTable8‐1,dependingonthe
durationofeachloadeventthatinducessustainedstress.
d. Theinitialcrackdepthusedfordesignandanalysisofglassitemsshall:
1. Notbesmallerthanthree(3)timesthedetectableflawdepthbased
ontheNDImethodsused.
2. Besubjectto
approvalbythecustomer.
e. Thesmallestcrackaspectratiousedforanalyticallifepredictionsshallbe
a/c=0,1.
f. Crack growth properties at 100% moisture shall be used for life
predictions.
g. Proof testingorNDI,consistentwiththeloadingexpectedduringservice
life, shall be conducted
to screen for manufacturing flaws in each
potential fracture‐critical glass item based on the result of the fracture
mechanicsanalysis,withthefollowingconditions:
1. Proof testing is performed for acceptance of pressurized glass
components(suchas windows andviewports)to screen the flaws
larger than the initial crack depth,
with minimum proof pressure
oftwo(2)timestheMDP.
2. Prooftestingisperformedinanenvironmentsuitabletolimitflaw
growthduringtest.
3. Humidityand encapsulated water isremoved fromthe surface of
theglassbeforeprooftesting.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
61
NOTE Encapsulatedwatercanbeaccumulatedduring
e.g.storagebeforeprooftesting
h. If a factor of safety on strength of 5 or greater can be shown, and if
approvedbythecustomer,theprooftestinconformancewith
8.7g.1may
beomitted.
i. It shall be demonstrated that glass inside a habitable area is safe from
breakage by safe life verification in conformance with
8.7b, or is
contained,orthatreleasedparticlesaresmallerthan50µm.
Table8‐1:Factoronstressforsustainedcrackgrowthanalysisof
glassitems
Durationofsustainedstressevent Factoronst ress
life≤1week 1,4
1week<life≤1month 1,3
1month<life≤1year 1,2
life>1year 1,1
NOTE Thefactoronstressislargerforshorterdesignlifebecauseoftheflaw
growthvelocitysensitivitytosmallvariationsinthestressintensity
8.8 Fasteners
a. Fasteners smaller than diameter 5mm (or 3/16”) shall not be used in
safelifeapplications.
b. Titaniumalloyfastenersshallnotbeusedinsafelifeapplications.
c. All potential fracture‐critical fasteners shall be procured and tested in
conformance with aerospace standards for structural fasteners or
equivalentspecifications
agreedwiththecustomer.
NOTE For example, LN, AIR and NAS standards, or
ISO, EN and national standards which are
explicitlyintendedforaerospaceapplications.
d. Fastenersprocuredandtestedinconformancewithaerospacestandards
fornon‐structuralfastenersshallnotbeused.
NOTE For those secondary connections where
significantredundancyexistsandfatigueisnot
amajorconcern,sometimessuchnon‐structural
fasteners are applied. This is agreed with the
customeronacasebycasebasis.
e. All safelife fasteners shall be marked and stored separately following
NDIorprooftesting.
f. Safelifefastenersshallbe
NDI‐inspectedby the eddy current method in
theshank,headfillet,andthreadareas.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
62
g. The standardcracksizetobeconsideredinthethreadandfilletarea for
the safelife fasteners, inspected as required in
8.8f, shall be
a=c=1,91mm.
NOTE This assumes rolled thread and fillet, in
conformancewith
8.8c.
h. Applicationofrivetsshallconformtotherequirementsforfail‐safeitems
ofclause
6.3.2.
NOTE Rivets are permanently deformed during their
installation,andthereforecannotbeadequately
inspectedforcracksintheinstalledcondition.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
63
9
Material selection
a. Materialsshall be selected and controlledin conformance with ECSS‐Q‐
ST‐70“Materials,mechanicalpartsandprocesses”.
NOTE The material selection process takes into
account structural and non‐structural
requirements. The materials selected possess
the appropriate fracture toughness, crack‐
growth characteristics, and structural
properties,suchasYoung’smodulus
andyield
strength,inspecifiedenvironmentalconditions.
b. Where validated properties for analysis are not available, or available
propertiesarenotvalidatedbystandardorothertestproceduresagreed
withthe customer,the statistical basis foraverageand minimum values
shallbeestablishedbytests.
c. For applicationswhere failure of
a material can resultin catastrophic or
critical hazard, alloys which possess high resistance to stress‐corrosion
cracking in conformance with Table 5‐1 (Alloys with high resistance to
stress‐corrosioncracking)ofECSS‐Q‐ST‐70‐36shallbeused.
NOTE Strength, fracture and fatigue properties for a
large
number of aerospace materials are
documented in the ESA developed materials
database “FRAMES‐2”, which can be obtained
fromMechanicalSystemsDepartment,ESA.
Furtherexamplesoffrequentlyusedsourcesfor
material data are the Metallic Materials
Handbook (DOT/FAA/AR‐MMPDS) and
Aerospace Structural Metals Handbook
(CINDAS/Purdue)
ECSS‐E‐ST‐32‐01CRev.1
6March2009
64
10
Quality assurance and Inspection
10.1 Overview
ForqualityassurancerequirementsseeECSS‐Q‐ST‐20“Qualityassurance”.For
materials selection and quality control requirements see ECSS‐Q‐ST‐70
“Materials,mechanicalpartsandprocesses”.
10.2 Nonconformances
a. FordispositioningofnonconformancesforPFCIs,areassessmentofthese
itemstoverify conformancewiththefracturecontrolrequirements shall
beperformed.
NOTE For nonconformances control see ECSS‐Q‐ST‐
10‐09.
b. All nonconformances which affect fracture‐critical items and primary
structuralhardwaredesignedtosafelifeprinciples
shallbedispositioned
as“majornonconformances”.
10.3 Inspection of PFCI
10.3.1 General
a. AllPFCIshallbesubjecttoaninspectionprogramme,inordertovalidate
the analytical life predictions and to permit hardware to be released as
acceptable.
b. NDIshallbeperformedforthecompleteitems.
NOTE The NDI to beapplied toan item(orregionof
anitem)
isbasedonthemostcriticallocationof
theitem(orregionoftheitem).
c. Detecteddefectsshallbetreatedasspecifiedinclause
10.7.
d. Inspectionsshallbeimplementedforlimitedlifeitems,asneeded.
e. Rolledthreadsshallnotbeetched.
NOTE This refers to both the inspection for cracks of
safe life fasteners (where eddy current
ECSS‐E‐ST‐32‐01CRev.1
6March2009
65
inspection is preferred in conformance with
8.8f), and penetrant inspection of other
fastenerswhichissometimesperformedaspart
ofprocesscontrol.
f. Verification of structural redundancy for fail‐safe items shall be
performedbeforeeachflight.
g. Post test NDI shall be performed for all proof‐tested items (where the
prooftestisnottheNDI
method).
NOTE With approval of the customer, the post test
NDI can focus on areas with increased
probability of defects, e.g. focusing on welds,
castings,forgings,bonds,andcompositeparts.
h. Inspectionofallweldsshallincludeasearchforsurfaceflawsaswellas
embeddedflaws.
i. 100%
inspection of all fusion joints of pressurized lines shall be
performedbeforeandafterprooftest,usingaqualifiedNDImethod.
NOTE After proof testing the NDI can be limited to
100%surfaceflawinspection,andre‐inspection
ofareaswithdetectedpores/porosity.
j. NDI requirements shall be stated on
design and manufacturing
documentation.
k. Inspection shall be performed by qualified personnel, certified for the
relevantinspectionmethod,inconformancewithNAS410,orEN4179or
equivalentstandardagreedwiththecustomer.
l. TheappliedNDIproceduresandthejustificationoftheircrackdetection
capabilityshallbeapprovedby
thecustomer.
NOTE This applies to all NDI procedures applied for
implementation of fracture control, including
standardNDIprocedures.Seealso
10.4.2.1c.
m. Dedicated jigs, fixtures and equipment needed to perform re‐inspection
afterdeliveryshallbedeliveredwithfracture‐criticalitems.
10.3.2 Inspection of raw material
a. Raw materials for all safe life, fail‐safe and low‐riskfracture items shall
be inspected to ensure conformance with the general material quality
specificationandabsenceofunacceptableembeddedflaws.
b. For metallic items, the raw material inspection shall be performed in
conformancewithAMS‐STD‐2154,ClassA
asaminimum.
NOTE Alternative equivalent inspection methods are
subjecttocustomerapproval.
c. ForsafelifeitemsrequiringspecialNDI,therawmaterialinspectionshall
be performed in conformance with SAE
AMS‐STD‐2154, ClassAA as a
minimum.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
66
d. Thehardwaredeveloperofcomposite,bondedandsandwichitemsshall
enforce a rigorous programme to control contamination and foreign
objectdebris(FOD)duringprocessing.
e. Glass items shall be inspected and proof tested in conformance with
clause
8.7.
f. Other non‐metallic items shall be inspected and proof tested in
conformancewithclause
8.5.
10.3.3 Inspection of safe life finished items
a. Inspection of all finished safe life items by the NDI method relevant to
theassumedinitialflawsizeshallbeperformed.
b. Metallicsafelifeitemsshallbeinspectedinconformancewithclause
10.4.
c. Items to be inspected using penetrant, shall have their mechanically
disturbedsurfacesetchedpriortoinspection.
NOTE Seealsoclause
10.4.3.2forthecaseofstandard
penetrantNDI.
d. Where etching or inspection cannot be performed on the finished part,
that etching and penetrant‐inspection shall be performed at the latest
practicalstageoffinishing.
NOTE For example, before final machining of parts
with precision tolerances, or at the assembly
levelbeforeholesaredrilled.
e. Composite, bonded and sandwich safe life items shall be inspected and
prooftestedinconformancewithclause
10.5.
f. Safe life items made of glass shall be inspected and proof tested in
conformancewithclause
8.7.
g. Safe life items made of other non‐metallic materials shall be inspected
andprooftestedinconformancewithclause
8.5.
h. Fortransparentopticalelements,astandardinitialcracksizeof2,54mm
length shall be used when visual inspection with 10 times or higher
magnification is performed with lighting applied at right angles to the
actualflaworientation.
NOTE1 Example of such transparent optical elements are
windowsand
lenses.
NOTE2 Thisvisualinspectionmethoddetectsbothsurface
andembeddedflaws.
i. Exceptforglassitems,visualinspectionshallnotbetheonlyNDI.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
67
10.4 Non-destructive inspection of metallic materials
10.4.1 General
a. Non‐destructiveinspection(NDI)levelsshallbecategorizedasstandard
NDI,specialNDIorprooftestingNDI.
b. The responsible for planning, definition and supervision of special NDI
activitiesshallhave a qualificationlevel3inconformancewithNAS410
orEN4179.
10.4.2 NDI categories versus initial crack size
10.4.2.1 Standard NDI
a. TheinitialcracksizesandgeometriesasdefinedinTable10‐1shallapply
forstandardNDIofmetallicmaterials.
NOTE Initial crack geometries are shown in
Figure
10‐1,
Figure10‐2andFigure10‐3.
b. For the standard NDI level of inspection one or more of the following
standardindustrialNDItechniquesappliedtometallicmaterialsshallbe
used:
⎯ Fluorescentpenetrant
⎯ X‐ray
⎯ Ultrasonic
⎯ Eddycurrent,or
⎯ magneticparticle.
c. Implementation of standard NDI on metallic parts based on the crack
sizesof
Table10‐1maybeperformedwithoutaformaldemonstrationof
thecrackdetectioncapabilityspecifiedin
10.4.2.1d.
NOTE The crack size data in
Table 10‐1 are based
principallyonNDIcapabilitystudiesthatwere
conducted on flat, fatigue cracked panels.
When the component’s geometrical features,
such as sharp radii, fillets, recesses, surface
finish and cleanliness, material selection,
reduced accessibility and other conditions can
influencethedetectioncapabilityoftheapplied
standardNDImethod,
themethodisevaluated
basedonsimilaritywithprovenapplicationsor
demonstration testing on a small number of
samples representative of the minimum
detectablecracksize.Thisisdonetoensurethat
thedetectioncapabilityoftheappliedstandard
NDIinspectionisnotinfluenced.
d. StandardNDIshallbeperformed
inconformancewithMIL‐HDBK‐6870.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
68
e. Standard NDI shall provide crack detection to at least 95% confidence
and90%probabilitylevel.
NOTE
Table 10‐1 gives, for various NDI techniques
andpartgeometries,thelargestcracksizesthat
canremainundetectedattheseprobabilityand
confidencelevels.
f. RadiographicNDIstandard flaw sizes(that are only applicableforflaw
orientationintheX‐radiationplane)shallnotapplytoverytightflaws.
NOTE
Forexample,tightflawsare:forgingflaws,heat
treatment induced flaws, welding induced
cracks, fatigue cracks, flaws in compressive
stressfield.
g. For tight flaws referred to in
10.4.2.1f, special NDI requirements shall
applyasdefinedin
10.4.2.2.
10.4.2.2 Special NDI
a. Special NDI shall be used only in special cases where limited life is
demonstrated for standard initial crack sizes and serious problems can
occur as a result of redesign or acceptance of the limited life, and its
applicationissubjecttoapprovalbythe customer.
b. A statistical demonstration of
90% probability of detection with 95%
confidenceshallbeperformedforthespecialNDImethod.
NOTE The demonstration is specific to the relevant
procedure,partandindividualinspector.
c. The demonstration specified in
10.4.2.2b shall be carried out on
specimensrepresentativeoftheactualconfigurationtobeinspected.
d. For NDI processes which are fully automated, the statistical
demonstration of
10.4.2.2b may be replaced by verification by test of
processparametersandtheirtoleranceswhichcanaffectthesensitivity.
NOTE Forexample,automatededdycurrentscanning.
e. Intheverificationbytestspecifiedin
10.4.2.2d,aminimumof5samples
shallbeused,whichcoverthefullrangeofparametersofthecrackstobe
detected by the automated process, in combination with the structural
detailstobeinspected.
10.4.2.3 Crack Screening Proof Test
a. Where proof testing of a flight item is performed as a screening or
inspection technique for cracks, which are larger than the initial cracks
used in the analytical life prediction, in the proof tests performed,
proceduresandstressanalysispredictionsshallensurethatthepredicted
stresslevelanddistributionare
actuallyachieved,andthattheabsenceof
testfailureensuresthatthecracksofthesizestobescreenedoutarenot
presentinanycriticallocationorinanyorientationoftheitem.
b. Where proof testing of a flight item is performed as a screening or
inspection technique
for cracks, which are larger than the initial cracks
ECSS‐E‐ST‐32‐01CRev.1
6March2009
69
used in the analytical lifeprediction, cracks screened by proof test shall
have aspect ratios identical to the initial cracks applied in the analytical
lifeprediction.
c. Where proof testing of a flight item is performed as a screening or
inspection technique for cracks, which are larger than the initial cracks
used in the analytical life prediction, the justification of the proof test
procedureshallbeprovided,whichincludesalleffectsthatcanaffectthe
prooftestdefinition,includingasaminimum:
1. Potential of stable crack growth beyond the crack size to be
screenedduringtheprooftest.
NOTE This
results in unacceptable degradationof the
flighthardware.
2. Weldandparentmaterialinhomogeneitiesifweldsarepresent.
3. Environment, if testing and operations are at different
environmentalconditions.
d. Where proof testing of a flight item is performed as a screening or
inspection technique for cracks, which are larger
than the initial cracks
used in the analytical life prediction, proof test procedures shall be
submittedtothecustomerforapprovalpriortothestartoftesting.
NOTE1 Proof testing can result in the applicationof loads
substantiallyinexcessofthoseusuallyimposedon
flight hardware in order to
screen for cracks of
sufficientlysmallsize.Thiscanresultinsignificant
risk to damage and reject otherwise acceptable
hardware.
NOTE2 Requirements for crack growth and critical crack
sizeanalysisarespecifiedinclause
7.Asignificant
amountoftestdatacanbenecessarytovalidateor
complement the analysis results in order to limit
the risk of damage to flight hardware. Advanced
non‐linear fracture analysis methodology is
normally applied to accurately predict the
behaviour of cracks under proof loading, except
for e.g. thick
‐walled items with part‐through
cracks where the minimum remaining ligament
(material thickness ahead of crack tip) is greater
than 2,5 (K
1c/ σy)
2
. A crack screening proof test of
thin‐walled items is generally not recommended
because of the increased risk of damage due to
stablecrackgrowthduringtheprooftest.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
70
Table10‐1:Initialcracksizesummary,standardNDI
NDImethod Crack
location
Part
thickness
t
[mm]
Crack
configuration
number
(seeNOTE1)
Cracktype Crackdepth
a
[mm]
Crack
length
c
[mm]
Open
surface
t ≤1,27
t>1,27
4
1,3,8
through
surface
t
0,51
1,27
1,27
2,54
1,27
Edgeorhole
t≤1,91
t>1,91
5,9
2,7
through
corner
t
1,91
2,54
1,91
Eddycurrent
NDI
Cylinder
N/A
10 surface seeNOTE2 1,27
Open
surface
t ≤1,27
1,27≤t≤1,91
t>1,91
4
4
1,3,8
through
through
surface
t
t
0,81
1,91
2,54
3,82‐t
4,05
1,91
Edgeorhole
t≤2,50
t>2,50
5,9
2,7
through
corner
t
2,54
2,54
2,54
PenetrantNDI
Sensitivity
Level≥3
Cylinder
N/A
10 surface seeNOTE2 1,91
Open
surface
t≤3,0
t>3,0
4
1,3,8
through
surface
t
3,00
1,50
3,00
3,00
7,50
Edgeorhole
t≤3,0
t>3,0
5,9
2,7
through
surface
t
3,00
3,00
3,00
PenetrantNDI
oftitanium
alloys,welds
andSensitivity
Level<3forall
othermaterials
Cylinder
N/A
10 surface seeNOTE2 3,00
Open
surface
t≤1,91
t>1,91
4
1,3,8
through
surface
t
0,97
1,91
3,18
4,78
3,18
Edgeorhole
t≤1,91
t>1,91
5,9
2,7
through
corner
t
1,91
6,35
6,35
Magnetic
ParticleNDI
Cylinder
N/A
10 surface seeNOTE2 3,18
Radiographic
NDI
Open
surface
0,63≤t≤2,72
t>2,72
1,2,3,7,8 surface 0,7×t
0,7× t
1,91
0,7×t
UltrasonicNDI Open
surface
t≥2,54 1,2,3,7,8 surface 0,76
1,65
3,81
1,65
NOTE1 Thecrackconfigurationnumbersrefertothecrack configurationsshowninFigure10‐1,Figure10‐2andFigure
10‐3.
NOTE2 Forcylindricallyshapeditems(seeFigure10‐3)thecrackdepthacanbederivedfromthecracklengthcofthis
tablefora/c=1,0withthefollowingformula:
)sectan1(
r
c
r
c
ra −+=
Exception:fastenerthreadandfillets,seeclause
8.8.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
71
10.4.3 Inspection procedure requirements for
standard NDI
10.4.3.1 Standard radiographic NDI
a. Radiographic inspection for the detection of volumetric flaws shall be
performedinconformancewithASTME1742.
b. The radiographic quality level shall be equal or better than 2‐1T
(clause6.9ofASTME1742).
c. The radiation of the beam shall be within ±5° of the orientation
of the
planeofthecracktobedetected.
NOTE Radiographic exposures at different
orientations can be needed to ensure that the
complete volume of an item is sufficiently
inspectedforpotentiallycriticalcracksthatcan
beinawiderangeoforientations.
10.4.3.2 Standard penetrant NDI
a. Penetrant NDI standard flaw sizes shall only be applied to fluorescent
dyepenetrantsoflevel3sensitivityorbetteras definedinASTME1417
orSAE
AMS2644.
NOTE Fluorescent penetrants of level 2 sensitivity or
better as defined in ISO3452‐2 can be
consideredequivalent.
b. For metals other than titanium, inspected with fluorescent penetrant to
less than level3 sensitivity as defined in
10.4.3.2a, the standard crack
sizesof
Table10‐1,definedfortitaniumalloysshallbeapplied.
c. All machined, or otherwise mechanically disturbed surfaces, to be
penetrant inspected, shall be etched to assure removal of masking
material prior to penetrant application for all processes and materials,
wheremaskingcanappear.
d. For welds, the standard crack sizes
of Table 10‐1, defined for titanium
alloys, shall be used in all cases, unless the weld surface is smoothened
afterweldingtoalevelagreedwiththecustomer.
NOTE Limited verification of the crack detection
capability of the actual weld inspection can be
appropriate.Seealso
10.4.2.1c.
e. InterfacesurfacefinishshallbeR
a=3,2μmorlower.
10.4.3.3 Standard ultrasonic NDI
a. Ultrasonic inspection shall be in conformance with SAE AMS‐STD‐2154
ClassAasaminimum.
b. Lineardiscontinuitiesofanylengthshallnotbeaccepted.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
72
c. Ultrasonic inspection shall be performed using longitudinal or shear
waves, applied via unobstructed bare flat surfaces, at right‐anglesto all
possibleorientationsofthecrackstobedetected.
d. InterfacesurfacefinishshallbeR
a=3,2μmorlower.
e. Ultrasonic inspection for surface or embedded flaws in welds or in parent
materialsurroun dingtheweldsshallbeinconformancewithASTME164.
10.4.3.4 Standard eddy current NDI
a. EddyCurrent inspection shall be in conformancewith ASTME426 or a
standardapprovedbythecustomer.
b. A minimum signal‐to‐noise ratio of 3:1 shall be achieved for standard
NDI.
c. For automated inspection or inspection with signal recording and
analysis a reduction of this ratio, as
approved by the customer, may be
applied.
d. TheinterfacesurfacefinishshallbeR
a=3,2μmorlower.
10.4.3.5 Standard magnetic particle NDI
a. MagneticparticleinspectionshallbeinconformancewithASTME1444.
b. Thewetprocess,continuousmethodtechnique,withfluorescentparticles
shallbeused.
c. InterfacesurfacefinishshallbeR
a=3,2μmorlower.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
73
2
c
t
W
1
2c
a
5
4
3
2c
6
e
2a
Embedded cracks
Through cracks
Part-through cracks
W
W
WW
W
t
t
t
a
a
2c
t
t
c
2c
Figure10‐1:Initialcrackgeometriesforpartswithoutholes
ECSS‐E‐ST‐32‐01CRev.1
6March2009
74
Through cracks
8
7
9
Part-through cracks
O
t
a
W
2c
a
t
t
c
c
W
W
Figure10‐2:Initialcrackgeometriesforpartswithholes
(10)
Figure10‐3:Initialcrackgeometriesforcylindricalparts
10.5 NDI for composites, bonded and sandwich parts
10.5.1 General
a. ThestandardsEN4179orNAS410shallbeappliedforallNDImethods
explicitlyaddressedbythesestandards.
NOTE If NDI methods are used which are not
explicitly addressed by EN 4179 or NAS410,
applyclause
10.5.2.2.2a.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
75
b. The inspectors shall be certified to at least level2 for the NDI method
used.
c. TheNDIprocedureshallbeapprovedbyalevel3inspector.
d. ThecapabilityofeachappliedNDIshallbedemonstratedbythesupplier
inconformancewithclause
10.5.2.2.
NOTE Theconcepts of standardNDI andspecialNDI
are not applicable for composite, bonded and
sandwichparts.
10.5.2 Inspection requirements
10.5.2.1 Close visual inspection
a. Themaximumdistancetoperformthe inspectionshallbe0,3m;
b. Aninspectionprocedureshallbewritten,whichspecifies:
1. Accessrequirements
2. Distancebetweeneyesandinspectedarea
3. Optimumlighting
4. Cleaning
5. Thelocationofthesuccessiveinspectedarea
6. Theminimuminspectiontimeneededto
inspecteacharea.
NOTE Aformalstatisticalcapability demonstration of
the detectability of the VDT by means of close
visual inspection is not needed, but the
procedure is agreed between customer and
supplier.
c. When an indication is found, optical magnification (lenses) and other
NDImethodsshallbeappliedto
determinewhetheritornottoconsider
itasadetecteddefectinconformancewith
10.7.
10.5.2.2 NDI methods other than close visual inspection
10.5.2.2.1 General
a. Applied NDI methods shall provide crack detection to at least 90%
probabilitylevel(confidencelevel95%)inconformancewith
10.5.2.2.1b.
b. Thecapability ofanNDImethod (i.e. the reliably detectable defectsize)
shallbedemonstratedbytestonspecimenswithinduceddefects.
c. Specimenswithinduceddefectsshallbeusedintheinspectionprocedure
asstandardforcalibration.
d. Thecapabilityoftheinspectionmethodshallbeinvestigatedon
atleast5
specimensinordertoanalysealldefectparameters.
NOTE1 Defectparameterstobeinvestigatedincludedefect
type,position,size,shapeandorientation.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
76
NOTE2 Dependingone.g.thecomplexityoftheitemtobe
inspected and the criticality of the defects to be
found the number of samples to be used can be
significantlyhigherthan5.
e. The cases where proof test monitoring by acoustic emission can be
performedinsteadofposttestingNDIshallbeagreedwiththecustomer.
NOTE The proof test can be used to screen for
manufacturing defects as specified in clause
8.4.4.2.
10.5.2.2.2 Other NDI methods but those addressed in EN 4179 or
NAS 410
a. Inthecasesotherthanthoseaddressedby10.5.1a,theprocedureshallbe
writtenbyanexpertfortheNDImethod.
NOTE For example, the procedure can be written by
anoperatorpracticingthismethod.
b. Inthecasesotherthanthoseaddressedby
10.5.1a,theprocedureshallbe
approved by a level3 inspector for a similar NDI method covered by
EN4179orNAS410.
NOTE1 The certification of the level3 inspector can be
considered similar when obtained for a method
applicable to composite parts and based on the
mostsimilar
physicalprinciple.
NOTE2 For example, X‐ray certification for tomography
method.
c. Inthecasesotherthanthoseaddressedby
10.5.1a,theprocedureshallbe
based on the same rules as those used for NDI methods explicitly
addressedbythestandardsEN4179orNAS410.
d. Inthecasesotherthanthoseaddressedby
10.5.1a,theimplementedNDI
methodshallbedocumentedandthephysicalprinciplesusedexplained.
10.6 Traceability
10.6.1 General
a. Traceability of PFCI and the materials they are made of shall be
implemented in conformance with ECSS‐Q‐ST‐20 to provide assurance
that:
1. The material used in the manufacture of structural hardware has
properties fully representative of those used in the analysis or
verificationtests.
2. Structural hardware
is manufactured and inspected in
conformance with the specific requirements for the
implementationofthefracturecontrolprogramme.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
77
10.6.2 Requirements
a. All associated drawings, manufacturing and quality control
documentation shall identify that the item is a potential fracture‐critical
item(unless when it is a fail‐safeor low‐riskfracturemetallicitem)ora
fracturecriticalitem.
b. Each fracture‐critical item shall be traceable by its own unique serial
number.
c. Each fracture‐critical item shall be identified as fracture‐critical on its
accompanyingtaganddatapackage.
d. For each fracture‐critical item a log shall be maintained, which
documents the environmental and operational aspects (including fluid
exposureforpressurevessels)ofallstorageconditionsduringthelife
of
theitem.
e. For each fracture‐critical item a log shall be maintained, which
documentsallloadingsduetotesti ng,assemblyandoperation,including
pressurecyclesandtorqueingoffasteners.
10.7 Detected defects
10.7.1 General
a. Safelife andfailsafe items with detected defectswith asizelarger than
the following, shall be subjected to additional verification requirements
asdefinedinclause
10.7.2:
⎯ Theacceptancecriteriausedinthemanufacturingprocess;or
⎯ 50% of the maximum allowed detectable NDI size in any
dimension;or
⎯ 50% of the standard NDI size defined in Table 10‐1, for metallic
materials
NOTE1 Acceptancecriteriaforflawsinthemanufacturing
process ensure that material property values are
not reduced below the qualified minimum values
usedfordesign.
Detailed requirements for acceptance criteria
for flaws other than crack‐like defects are not
withinthescopeofthis
ECSSstandard.
NOTE2 For example, definition of acceptance criteria for
defectsincludesconsiderationofultimatestrength,
fatiguelife,leakage.
b. AnyPFCIcontainingdetecteddefectsshallnotbeusedwithoutapproval
ofthecustomer.
NOTE1 The first option to be considered when a defect is
detected in flight
hardware is to remove or repair
thedefect.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
78
NOTE2 Forhighlycriticalhardware(especiallywhenused
for manned spaceflight), more conservative
verification methodology can be requested by the
customer(seee.g.NASA‐HDBK‐5010).
c. Lowriskfractureitemsshallnotcontaindetecteddefects.
10.7.2 Acceptability verification
10.7.2.1 Safe life parts with a detected defect
10.7.2.1.1 General
a. The detected defect shall be verified as crack‐like defect, and a fracture
mechanics analysis or test performed to verify the acceptability of this
defect.
NOTE Onlyinthecaseofawell‐knowntypeofdefect
(e.g. pores) for which a data base of
representative test data is
available, an
assessment without replacing the defect by a
crackcanbeused.
b. Theanalysisortestshallbeperformedasfollows:
1. Define the dimensions and location of the detected defect
conservatively(e.g.forasurfacecrackthelengthanddepth).
2. In the case of irregular defect shapes
or grouped defects, make a
recharacterisation for the analytical prediction (in the case of
metallic part) or for test with induced defect (for metallic or
compositepart).
NOTE For metallic parts, flaw characterization as
proposed by BS7910 or ASME boiler and
pressure vessel code SectionXI, article IGA‐
3000
canbeapplied.
3. Demonstratebyanalysisthatthestressesusedareconservative.
NOTE Improved analysis methods, which are
subjected tocustomer approval, can be needed
toachievethis.
c. There shall be no indication that the cause of the defect affects the
validityofthematerialpropertiesusedin
thesafelifeverification.
d. The analysis or test shall demonstrate ultimate load capability at the
beginningoflife.
10.7.2.1.2 For metallic parts
a. The safe life crack growth analysis shall be performed as specified in 7,
withthecompleteloadspectrumapplied6timesinsequence.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
79
b. Cases where the analysis specified in 10.7.2.1.1a can be replaced by a
representative fatigue test of a part containing a representative defect
otherthanacrackshallbeagreedwiththecustomer.
NOTE Thisisagreedonlyinthecaseofawell‐known
typeofdefect.
c. The fatigue test specified in
10.7.2.1.2b shall demonstrate limit load
capability after application of the complete load spectrum 6 times in
sequence.
10.7.2.1.3 For composite, bonded and sandwich parts
a. Thesafelifeverificat ionshallbeperformedinconformancewithclause8.4.
10.7.2.2 Fail safe parts with a detected defect
a. The part shall meet the requirements in 6.3 for safe parts using the
detecteddefectinconformancewith
10.7.2.2b.
b. For the verification of
10.7.2.2a, the detected defect shall be assumed in
themostunfavourablesituation.
NOTE1 This means the situation where the choice of the
failed part places the detected defect in the most
unfavourablyloadedremainingpart.
NOTE2 This includes fatigue, verification, considering the
detected defects. Alternatively, it can be
demonstrated
that thestructure canwithstand the
failure of any other part, in addition to failure of
parts containing detected defects (using safety
factors as specified in
6.3.3, and without
consideringadefectintheremainingstructure).
c. Formetallicpartsthedetecteddefectshallbeverifiedascrack‐likedefect,
andafracturemechanicsanalysisortestshallbeperformedtoverifythe
acceptabilityofthisdefect.
NOTE Onlyinthecaseofawell‐known
typeofdefect
(e.g. pores) for which a data base of
representative test data is available, an
assessment without replacing the defect by a
crackcanbeused.
d. For composite,bonded andsandwich parts the fatigueverification shall
bebasedontestsofrepresentativedefects.
10.7.3 Improved probability of detection
a. If the origin of a detected defect is not uniquely determined and
eliminated,andregularoccurrenceofsignificantcrack‐likedefectsisnot
excluded by means of improvement of the manufacturing process, an
improved NDI method approved by the customer shall be used, such
that it provides a probability higher
than 90% of detection of
unacceptabledefects.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
80
11
Reduced fracture control programme
11.1 Applicability
As specified in 5.1 for unmanned, single‐mission, space vehicles and their
payloads, and for GSE, a reduced fracture control programme (RFCP) as
defined in this clause can be implemented, instead of the general fracture
controlprogramme.
11.2 Requirements
11.2.1 General
a. Areduced fracture control programme shall be in conformance with all
therequirementsgiveninthisstandard,withthemodificationsspecified
in
11.2.2.
11.2.2 Modifications
11.2.2.1 Identification of PFCIs
a. TheidentificationofPFCIsmaybelimitedtothefollowingitems:
1. Pressurizedsystems.
2. Rotatingmachinery.
3. Fastenersusedinsafelifeapplications.
4. Items fabricated using welding, forging or casting and which are
used at limit stress levels exceeding 25% of the ultimate tensile
strengthofthe
material.
5. Non‐metallicstructuralitems.
6. Metallic structural items used in safe life applications, with limit
stress levels exceeding 50% of the yield tensile strength of the
material.
NOTE1 Whenapprovedbythecustomer,thescopeofthis
requirement can be reduced to single point of
failure items
loaded in tension with relatively
ECSS‐E‐ST‐32‐01CRev.1
6March2009
81
small cross‐section (examples: lugs, iso‐static
mounts,smallstrutorpin,GSEinterface).
NOTE2 ForPFCIs,see
6.1.
b. Theidentificationofpotentialfracture‐criticalitemsshallbeperformedin
conformancewiththeproceduregivenin
Figure5‐1.
11.2.2.2 Documentation requirements
a. The information specified in clause 6.4.2 may be consolidated into one
list;separatelistsneednotbeprepared.
11.2.2.3 Glass and non-metallic items other than
composites, bonded and sandwich items
a. Therequirementsofclauses8.5and8.7maybereplacedbythefollowing
requirement: structural glass and other non‐metallic items (other than
composites, bonded and sandwich items) shall be proof‐tested at 1,2
timesthelimitload.
NOTE It is well‐known that glass and other brittle
itemssubjectedtostaticloadcanbesensitive
to
growth of inherent flaws (i.e. static fatigue).
This effect is normally considered in the
structural verification, taking into account
empirical data (e.g. statistical methods, taking
intoaccountthesurfaceroughnessoftheitem).
11.2.2.4 Rotating machinery
a. The requirements of clause 8.6 may be replaced by the following
requirement:‘rotatingmachinery(wheelsandgyros)shallbeproof‐spin‐
testedatoneandonetenth(1,1)timesnominaloperationalspeed.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
82
Annex A (informative)
The ESACRACK software package
The ESACRACK software package is intended to be used for damage tolerance
analysis of spaceflight vehicles and payloads as well as ground support
equipment.Thepackageconsistsofvariousanalysistoolsthatenabletheuserto:
• Generateloadandstressspectra(ESALOAD)
• Performfracturemechanicsanalysis(NASGRO
®
moduleNASFLA)
• Generatestressintensityfactorsolutions(NASGRO
®
moduleNASBEM)
• Processcrackgrowthmaterialdata(NASGRO
®
moduleNASMAT)
• Performfatigueanalysis(ESAFATIG).
The flight load spectra distributed with ESACRACK have been derived for
payloads of the NSTS, and cannot be used for other structures without
adequateverification.
The software package ESACRACK can be obtained from Mechanical Systems
DepartmentofESA.
The data contained in the
standard materials data bases provided with the
NASGRO and ESAFATIG software, and the stress intensity and net section
stress solutions implemented in the NASGRO software, are generally
acceptable for fracture control analysis. The judgement of the applicability of
thesedatafortheactualhardwareremainstheresponsibility oftheuserof
the
software,however.
The material data in the NASGRO database are mean or typical values, and a
reduction as specified in clause
7.2.5 is therefore applied for the toughness
parameters. A reduction option is implemented in older versions of the
ESACRACKsoftware.
Caution:TheNASGROsoftwareoffersanumberofadvancedanalysisoptions
which are potentially unconservative and not allowed by this standard, or
require specifically validated material data (e.g. retardation models like
the
strip‐yield model, elastic‐plastic analysis, shakedown analysis). Application of
suchoptionsisnormallysubjecttocustomerapproval.
Insomecases(e.g.forfractureanalysisofdetectedcracks,fordeterminationof
defect acceptance criteria or proof test crack screening capability, or for crack
growthpredictionwherethespectrumcan
causeaccelerationof crackgrowth)
theapplicationofsuchadvancedoptionsinNASGROorotherfractureanalysis
softwarecanbenecessary.
ECSS‐E‐ST‐32‐01CRev.1
6March2009
83
Annex B (informative)
References
[R1] Broek, ‘The practical use of fracture mechanics’, 1989, Kluwer, ISBN
90‐247‐3707‐9.
[R2] Berger, Blauel, Pyttel & Hodulak, ‘FKM Guideline – Fracture
Mechanics Proof of Strength for Engineering Components’, 2nd
revisededition,2004,VDMAVerlagGmbH,ISBN3‐8163‐0496‐6.
[R3] Sierakoswki & Newaz, ‘Damage tolerance in
advanced composites’,
1995,TechnomicPublishing,ISBN1‐56676‐261‐8
[R4] ‘AerospaceStructuralMetalsHandbook’,CINDAS/PurdueUniversity
[R5] Saxena ‘Nonlinear Fracture Mechanics for Engineers’, 1998, CRC
Press,ISBN0‐8493‐9496‐1
[R6] Chell, McClung, Kuhlman, Russell, Garr, Donnelly, ‘Guidelines for
ProofTestAnalysis’,1999,NASA/CR‐1999‐209427
[R7] McClung,
Chell, Lee, Russell, Orient, ‘Development of a Practical
Methodology for Elastic‐Plastic and Fully Plastic Fatigue Crack
Growth’,1999,NASA/CR‐1999‐209428
ECSS‐E‐ST‐32‐01CRev.1
6March2009
84
Bibliography
ECSS‐S‐ST‐00 ECSS system – Description, implementation and
generalrequirements
ECSS‐Q‐ST‐10‐09 Space product assurance‐Nonconformance control
system
ISO3452‐2 Non‐destructive testing‐Penetrant testing‐Part 2:
Testingofpenetrantmaterials
NASA‐HDBK‐5010 ‘Fracture control implementation handbook for
payloads, experiments, and similar hardware’, 2005,
NASA
MIL‐HDBK‐17 CompositeMaterialsHandbook
BS7910 Guide on methods for assessing the acceptability of
flawsinmetallicstructures
